RepairNewACMEOrder - RIT-ITS/CertifiCat-PS GitHub Wiki

Attempts to re-finalize an ACME certificate order that has been validated but timed out.

Repair-NewACMEOrder  [-MainDomain <string>] 
    [-UpdateBindings] [-BindingPorts <string[]>]
    [-SkipImport] [-StoreLocation <string>] [-StoreName <string>]
    [-SkipCentralize] [-CentralDirectory <string>]
    [-debugEnabled] [-debugLogDirectory <string>] [-debugMode <string>]

In certain situations, Sectigo may take an extended period of time (more than 60 seconds) to issue a new certificate. When this happens, the Posh-ACME New-PACertificate command, which is run by our Initialize-NewACMECertificate function will timeout, and any downstream actions will suspend.

This function will analyze the current ACME order and, as long as the status is "valid," will attempt to complete the order, obtain the certificate, and perform any additional downstream steps that may be needed.

🏷️ Note that any downstream steps are based on the parameters specified in this function, rather than those that may have been specified when Initialize-NewACMECertificate was initially run.

⚠️ Warning: Certain parameter combinations cannot be run on versions of PowerShell above 6 at this time. For more information, see the PowerShell Requirements section in the System Requirements page.

If the function detects that it is being used in a PowerShell 7+ console, it will suspend, and output a command that can be run in a legacy PowerShell console instead. See the Parameters list below for affected parameters and parameter values (generically, this applies to anything related to IIS or bindings).

Repair-NewACMEOrder -MainDomain app.example.com

This command will finalize the order, download the certificate, import it into the LocalMachine\WebHosting store in the Windows Certificate store and copy the certificate files to the directory specified by the -CentralDirectory parameter.

Repair-NewACMEOrder -MainDomain app.example.com -UpdateBindings

This command will finalize the order, download the certificate, import it into the LocalMachine\WebHosting store in the Windows Certificate store, copy the certificate files to the directory specified by the -CentralDirectory parameter, and then update all IIS HTTPS bindings with the new certificate.

The primary domain associated with the certificate in the order

Type: String
Position: Named
Default Value: False
Required: True

When present, IIS bindings will be updated after the certificate is imported.

Type: SwitchParameter
Position: Named
Default Value: False
Required: False

⚠️ Warning: The switch cannot be run on versions of PowerShell above 6 at this time. For more information, see the PowerShell Requirements section in the System Requirements page.

If the function detects this parameter value being used in a PowerShell 7+ console, it will suspend, and output a command that can be run in a legacy PowerShell console instead.

Specifies the server which Posh-ACME will connect to and interact with.

Type: String[]
Position: Named
Default Value: False
Required: False

⚠️ Warning: The parameter cannot be run on versions of PowerShell above 6 at this time. For more information, see the PowerShell Requirements section in the System Requirements page.

If the function detects this parameter value being used in a PowerShell 7+ console, it will suspend, and output a command that can be run in a legacy PowerShell console instead.

When applied, the resulting certificate file will not be imported into the Windows Certifiate Store

Type: Switch
Position: Named
Default Value:  False
Required: False

Specifies the server which Posh-ACME will connect to and interact with.

Type: String
Position: Named
Default Value: LocalMachine
Required: False

Specifies the server which Posh-ACME will connect to and interact with.

Type: String
Position: Named
Default Value: WebHosting
Required: False

When applied, the resulting certificate files will not be copied from the Posh-ACME working directory to a central location.

Type: Switch
Position: Named
Default Value:  False
Required: False

When the -SkipCentralize parameter is omitted, this directory specifies where the new certificate files will be copied.

Type: String
Position: Named
Default Value: %PROGRAMDATA%\certificat-ps\certificates\<main domain>\<date as: MM-dd-yyyy-HH-mm-ss>
Required: False

This switch must be present to cause the function in question to output the contents of the object to a file or event log

Type: Switch
Position: Named
Required: False

Specifies where the CertifiCat-PS debug logs are written, when the debugMode option is EVT or Both.

Type: String
Position: Named
Required: False

Controls where the CertifiCat-PS debug informaiton is written: EVT (the windows event log), File (a text file on disk), or Both (a text file on disk and the Windows Event Log)

Type: String
Position: Named
Required: False
Default Value: EVT
ValidateSet: EVT, File, Both

Returns a custom PowerShell object with properties about the function and the account that was set up. The object has the following properties:

• Background on IIS in PowerShell 7
• Get-WebBinding
• Posh-ACME: Get-PAOrder
• Posh-ACME: Complete-PAOrder
• Posh-ACME: Install-PACertifiate