Get-STSCerts.ps1
Retrieves the vCenter Security Token Service (STS) signing certificate. Per KB79248 "If the vCenter Server was deployed as version 6.5 Update 2 or later, the Security Token Service (STS) signing certificate may have a two-year validity period. Depending on when vCenter was deployed, this may be approaching expiry."
This Powershell script/function will connect to the vCenter(s) specified, and retrieve the STS signing certificates from the vCenter LDAP database with their expiration dates.
Instructions:
- Open a Powershell command line, and change to the directory you saved the script in
- Use the command: ". ./Get-STSCerts.ps1" to load the function
- Run the command: Get-STSCerts -vcenters vcenter.domain.com -user administrator@vsphere.local -password P@$$w0rd
- If you don't specify the password, it will prompt you and obfuscate it as you type.
- The user MUST be a local account to vSphere. It can't be from an external source like AD
- The username has to be in the SPN format: username@domain.com
- For multiple vCenters, you can create an array of vCenters, and pipe it to the function
- $vCenters = "vcenter1.domain.com","vcenter2.domain.com","vcenter3.domain.com"
- $vCenters | -user administrator@vsphere.local -password P@$$w0rd
- For help, type "get-help Get-STSCerts" for examples, and details
Contributor
1463 Downloads
Created 3 years ago
Updated 1 year ago
Platform
VMware PowerCLI 6.7
vSphere 6.0-U2, 6.0, 6.1, 7.0, 6.5, 6.7
Language
PowerShell
When I test this againt s vCenter Server 6.5u2 I get an error on line 83 ($ldapconnect.bind)
the error = Exception calling "Bind" with "1" argument(s): "The LDAP server is unavailable."
Is this because I am using the ip address of the vCenter ( cannot use the DNS name because of some firewall rules)
thanks
Gert
It seems to be working fine for all of them except two, which are not listening on 389 or 636. Any idea where to check/enable that in vCenter?
Problematic vCenters are running vCenter 6.7 Build 15505374 and 16243230.
Script is working fine on other vCenters running 6.7 Build 16046713 and 15976728 and 16616668.
The error with problematic ones is the same as what @gertvangorp mentioned.
Run the command: Get-STSCerts -vcenters -vcenter.domain.com -user administrator@vsphere.local -password P@$$w0rd
Should be
Run the command: Get-STSCerts -vcenters vcenter.domain.com -user administrator@vsphere.local -password P@$$w0rd
(no dash before the server FQDN, otherwise you will get a Bind error)
I was able to run the commands in the instruction Point 1 and 2. But getting the below error for point 3. Any suggestion:
Get-STSCerts : The term 'Get-STSCerts' is not recognized as the name of a cmdlet, function, script file, or operable
program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1
Get-STSCerts -vcenters <vCenter> -user <User> -password <Password> |where {$_.daysremaining -lt 60}
$certificate = "" | Select vCenter,ValidFrom,ValidTo,DaysRemaining,Subject,Issuer
$cert = $request.Entries.attributes['userCertificate'].Item($i)
$X509Cert = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Certificate2(,$cert)
#$X509Cert.Import([byte[]]$cert)
$certificate.vCenter = $vCenter
$certificate.ValidFrom = $X509Cert.NotBefore
$certificate.ValidTo = $X509Cert.NotAfter
$certificate.Subject = $X509Cert.Subject
$certificate.Issuer = $X509Cert.Issuer
$today = get-date
$Expirydate = get-date $X509Cert.NotAfter
$certificate.DaysRemaining = (New-TimeSpan -Start $today -end $Expirydate).days
$certificates += $certificate
I am sure there is a more efficient way to do this, but for now it is working.
<User>@xyz.abc.something.something_else.vsphere.local
$userName = $user.Split("@")[0]
$domain = ($user.Split("@")[1]).Split(".")
ForEach ($Index in (0..($Domain.Count - 1) ) ) {$dcName = "dc="+($domain[$index])+","; $DCnameS +=$dcName}
$userDN = "cn=$userName,cn=users,"+($DCnameS.Trim(","))
ForEach ($Index in (0..($Domain.Count - 1) ) ) {$CNname = ($domain[$index])+"." ; $CNnameS+=$CNname }
$completeCN = "cn="+$CNnameS.Trim(".")
$basedn = "cn=TenantCredential-1,$completeCN,cn=Tenants,cn=IdentityManager,cn=Services,"+($DCnameS.Trim(","))