Powershell: StartSSL StartAPI für das automatisierte Validieren und Anfordern von SSL-Zertifikaten verwenden

# =============================================================================
# StartSSL automated domain validation and certificate request / (c) @colinardo
# =============================================================================

# ==== Start Variable section =======================================================
# comma seperated list of domains to create certificate for (first gets common name CN and others SAN)
$global:domains = 'domainXY.de,sub1.domainXY.de,sub2.domainXY.de'  
# Personal API-Token from startssl.com
$global:api_token = 'tk_XXXXXXXXXXXXXXXXXXXXXXXXX'  
# Path to API-Authentification certificate
$global:auth_cert_path = "$(Split-Path $MyInvocation.MyCommand.Definition -Parent)\my_domain_auth_certificate.p12"  
# Password of API-Authentification certificate
$global:auth_cert_password = 'VeryStrongPassword'  
# Path to store downloaded certificates to (default same as script path)
$global:outpath = Split-Path $MyInvocation.MyCommand.Definition -Parent
# ---- FTP-Data -------
# FTP-Path which corresponds to CN-Domain
$global:ftp_path = 'ftp://ftp.domain.de/subpath'  
# FTP-Username
$global:ftp_username = 'FTP-USERNAME'  
# FTP-Password
$global:ftp_password =  'FTP-PASSWORD'  

# certificate request
$global:csr = '-----BEGIN CERTIFICATE REQUEST-----  
MIICpDCCAYwCAQAwFjEUMBIGA1UEAxMLcm9ldGdlbi5uZXQwggEiMA0GCSqGSIb3
....
....
MmNmcPSKaJIFF71jXT7fhmkwvwwJUlIqrGgVMvpCEnZ8dPfdPCI3+ymaGMzcsW2U
bXCudv/Uf5w=
-----END CERTIFICATE REQUEST-----'  

# API URL Test-API: 'https://apitest.startssl.com' / Production-API: 'https://api.startssl.com' 
$global:APIURL = 'https://apitest.startssl.com'  

# <<<< End Variable section =======================================================

if ($PSVersionTable.PSVersion.Major -lt 3){write-host "ERROR: Minimum Powershell Version 3.0 is required!" -F Yellow; return}  

# create x509 certificate object from authentification cert file
$global:auth_cert = new-object System.Security.Cryptography.X509Certificates.X509Certificate2($global:auth_cert_path,$global:auth_cert_password)

# >>> Start Helper functions section =============================================
function md5([string]$string){
    [System.BitConverter]::ToString([System.Security.Cryptography.MD5]::Create().ComputeHash([System.Text.Encoding]::UTF8.GetBytes($string))).replace('-','').toLower()  
}
# <<<< End Helper functions section =============================================

# ------------------------------------------------------
# Fetches certificate from StartSSL
# (Returns a X509 certificate-object and saves ther certificate to defined outputfolder)
# ------------------------------------------------------
function Get-StartSSLCertificate(){
    param(
        [parameter(mandatory=$true)][ValidateSet('DVSSL','IVSSL','OVSSL','EVSSL')][string]$certType = 'DVSSL',  
        [parameter(mandatory=$true)][string]$domain,
        [parameter(mandatory=$true)][string]$csr
    )
    $body = @{
        tokenID = $global:api_token
        actionType = 'ApplyCertificate'  
        certType = $certType
        domains = $domain
        CSR = $csr
    } | ConvertTo-Json
    $body = "RequestData=$([System.Net.WebUtility]::UrlEncode($body))"  
    try{
        $result = irm -Uri $global:APIURL -Body $body -Method Post -Certificate $global:auth_cert -ContentType 'application/x-www-form-urlencoded'  
        if ($result.status -eq 1 -and $result.data.orderStatus -eq 2){
            if ((md5 $result.data.certificate) -eq $result.data.certificateFieldMD5){
                $outcert = "$outpath\$($domain.split(',')).crt"  
                write-host "Request was successfull, saving certificate to '$outcert' ..." -F Green  
                [System.IO.File]::WriteAllBytes($outcert,[System.Convert]::FromBase64String($result.data.certificate))
                return [System.Security.Cryptography.X509Certificates.X509Certificate]::CreateFromCertFile($outcert)
            }else{
                throw "There was a problem in certificate transmission, the MD5 of the submitted certificate did not match!"  
            }
        }elseif($result.status -eq 0 -and $result.errorCode -eq -1025){
            # domain name is not validated, initiate validation
            write-host "Domain is not validated, initiating validation process ..." -F Yellow  
            $val_result = Validate-StartSSLDomain -domain ($domain.split(','))  
            if ($val_result.status -eq 1){
                Get-StartSSLCertificate -certType $certType -domain $domain -csr $csr
            }else{throw $val_result}
        }else{
            throw $result
        }

    }catch{
        throw $_
    }
}

# ---------------------------------------------------------------
# Validate Domain ownership via html file upload to ftp of domain
# ---------------------------------------------------------------
function Validate-StartSSLDomain(){
    param(
        [parameter(mandatory=$true)][string]$domain
    )
    function Upload-File([string]$path,[string]$url,$username,$password){
        try{
            $request = [System.Net.FtpWebRequest]::Create($url)
            $request.Method = [System.Net.WebRequestMethods+FTP]::UploadFile
            $request.Credentials = New-Object System.Net.NetworkCredential($username,$password)
            [bytes[]] $bytes = [System.IO.File]::ReadAllBytes($path)
            [System.IO.Stream]$stream = $request.GetRequestStream();
            $stream.Write($bytes,0,$bytes.Length)
            $stream.Close(); $stream.Dispose()
            $response = [System.Net.FtpWebResponse]$request.GetResponse()
            $result = $response.StatusDescription
            $response.Close()
            return $result
        }catch{
            throw $_.Exception.Message
            return $false
        }
    }
    function Delete-FtpFile([string]$url,$username,$password){
        try{
            $request = [System.Net.FtpWebRequest]::Create($url)
            $request.Method = [System.Net.WebRequestMethods+FTP]::DeleteFile
            $request.Credentials = New-Object System.Net.NetworkCredential($username,$password)
            $response = [System.Net.FtpWebResponse]$request.GetResponse()
            $result = $response.StatusDescription
            $response.Close()
            return $result
        }catch{
            throw $_.Exception.Message
            return $false
        }
    }
    $body = @{
        tokenID = $global:api_token
        actionType = 'ApplyWebControl'  
        hostname = $domain
    } | ConvertTo-Json
    $body = "RequestData=$([System.Net.WebUtility]::UrlEncode($body))"  
    try{
        # first request for domain validation
        $result = irm -Uri $global:APIURL -Body $body -Method Post -Certificate $global:auth_cert -ContentType 'application/x-www-form-urlencoded'  
        if($result.status -eq 1){
            # upload validation html file to ftp server
            $result.data | Set-Content "$env:TEMP\$domain.html"  
            write-host "Uploading validation file to ftp server..." -F Green  
            Upload-File -path "$env:TEMP\$domain.html" -url "$ftpfolder/$domain.html" -username $global:ftp_username -password $global:ftp_password  

            # second request to initiate domain ownership validation
            $body = @{
                tokenID = $global:api_token
                actionType = 'WebControlValidation'  
                hostname = $domain
            } | ConvertTo-Json
            $body = "RequestData=$([System.Net.WebUtility]::UrlEncode($body))"  
            write-host "Validating domain ownership..." -F Green  
            $result = irm -Uri $global:APIURL -Body $body -Method Post -Certificate $global:auth_cert -ContentType 'application/x-www-form-urlencoded'  
            if($result.status -eq 1){
                write-host "Validation successful, removing validation file from ftp..." -ForegroundColor Green  
                Delete-FtpFile "$ftpfolder/$domain.html" -username $global:ftp_username -password $global:ftp_password  
                return $result
            }else{throw $result}
        }else{
            throw $result
        }
    }catch{
        throw $_
    }
}

# Initiate certificate process
Get-StartSSLCertificate -certType DVSSL -domain $domains -csr $global:csr

$global:APIURL = 'https://api.startssl.com'