Benachrichtigungen
Alles löschen
Exchange Server und Zertifikate
4
Beiträge
1
Benutzer
0
Reactions
2,116
Ansichten
Themenstarter 28. Juni 2020 20:57
Erst mal vielen Dank für deine Webseite.
Diese hat mir schon oft bei meinem Exchange Server weitergeholfen.
Ich habe bisher das Script (CA_v2_EX2010) bzgl. Let´s Encrypt im Einsatz.
Dieses lief ohne Probleme.
Daher vermute ich dass die Firewall richtig konfiguriert ist.
Jetzt versuche ich gerade auf das neue Skript v3 umzusteigen
Im Einsatz ist ein ein SBS2011 mit Exchange 2010 (Version: 14.03.0496)
WMF5.1 und Microsoft .NET Framework 4.8 ist installiert.
Ansonsten ist der Server soweit das möglich ist so ziemlich aktuell gehalten.
Hänge momentan bei der folgenden Meldung:
LE System - ERROR - Can't create Autorisation files for LE verification
Habe auf der Seite gelesen dass das neue Skript bereits erfolgreich auf SBS2011 läuft.
Daher hoffe ich dass das auch auf meinem Server laufen wird.
Anbei das Logfile
28.06.2020 21:32:26 - System - Info - Geting system parameters
28.06.2020 21:32:26 - System - Info - Certificate Assistant Exchange 2010 Version
28.06.2020 21:32:26 - System - Info - PowerShell Version: 5.1.14409.1018 OSVersion: 6.1.7601.65536
28.06.2020 21:32:26 - Check Posh-ACME - Info - Check if Module installed
28.06.2020 21:32:26 - Check Posh-ACME - Warning - Posh-ACME not installed, try to install it
28.06.2020 21:32:26 - Check Posh-ACME - Info - Using legacy installation method
28.06.2020 21:32:26 - Check Posh-ACME - Info - Try to download PackageManagement-MSI Path: C:\Users\xx\Documents\Zertifikate\Lets_Encrypt\poshacme.zip
28.06.2020 21:32:27 - Check Posh-ACME - Error - Installation failed or arborted
28.06.2020 21:32:27 - Load Posh-ACME - Info - Posh-ACME is installed, try to load it
28.06.2020 21:32:31 - Load Posh-ACME - Info - Module Import was successfull, PoshACMEVersion 0.0
28.06.2020 21:32:31 - Load Exchange SnapIns - Info - Try to load Exchange SnapIns
28.06.2020 21:32:32 - Load Exchange SnapIns - Info - Sucessfully loaded Exchange SnapIns
28.06.2020 21:32:33 - IIS - Info - Trying to create .Well-Known Directory
28.06.2020 21:32:34 - IIS - Info - Well-Known Folder already exists, skipping
28.06.2020 21:32:34 - IIS - Info - Added Mime Type to Well-Known Folder
28.06.2020 21:32:34 - IIS - Info - Changing Let's Encrypt IIS directory to http
28.06.2020 21:32:35 - IIS - Info - Successfully changed Let's Encrypt IIS directory to http
28.06.2020 21:32:35 - IIS - Info - Checking Let's Encrypt IIS directory to accept validation by http request
28.06.2020 21:32:35 - IIS - Info - .well-known directory accepts http
28.06.2020 21:32:35 - Custom FQDNs - Info - Using Custom FQDNs is configured
28.06.2020 21:32:35 - LE System - Info - Setting LE Mode
28.06.2020 21:32:35 - LE System - Info - Setting LE Mode to STAGE MODE (TESTING ONLY)
28.06.2020 21:32:35 - LE System - Info - Checking for existing LE Account
28.06.2020 21:32:35 - LE System - Info - Found a existing LE Account
28.06.2020 21:32:35 - LE Certificate - Info - Trying to create a new order for a certificate
28.06.2020 21:32:38 - LE Certificate - Info - Successfully ordered certificate
28.06.2020 21:32:38 - LE System - Info - Creating Autorisation files for LE verification
28.06.2020 21:32:39 - LE System - ERROR - Can't create Autorisation files for LE verification
28.06.2020 21:32:39 - LE System - Info - Asking LE to verify the order
28.06.2020 21:32:40 - LE System - Info - Successfully informed LE to verify the order
28.06.2020 21:32:40 - LE System - INFO - Let's give LE some time to validate (1 min)
28.06.2020 21:33:40 - LE System - INFO - Time to wake up, need coffee!
28.06.2020 21:33:40 - LE System - INFO - Let's check the authorization
28.06.2020 21:33:41 - LE System - INFO - Authorization for autodiscover.domain.at is valid
28.06.2020 21:33:41 - LE System - INFO - Authorization for graz.int.domain.at is valid
28.06.2020 21:33:41 - LE System - INFO - Authorization for graz.domain.at is valid
28.06.2020 21:33:41 - LE System - INFO - Authorization for autodiscover.domain2.com is valid
28.06.2020 21:33:41 - LE System - INFO - Let's refresh the order
28.06.2020 21:33:42 - LE System - INFO - Let's check if order is ready
28.06.2020 21:33:42 - LE System - ERROR - Order is NOT ready
Themenstarter 4. Juli 2020 11:05
Bin eventuell eine Schritt weiter, stehe aber noch immer an.
Habe folgende Forumeintrag gefunden.
( https://www.frankysweb.de/community/exchange2010/certificate-assistant-neue-version-12-2019/ )
und
$WebsitePath = (Get-Website "Default Web Site").PhysicalPath
durch
$Websitepath = (Get-Website *"Default Web Site"*).physicalPath
ersetzt.
Die 3 Zeilen mit $IISMimeType habe ich auskommentiert.
Jetzt hänge ich nicht mehr bei
LE System - ERROR - Can't create Autorisation files for LE verification
Sondern bin hoffentlich einen Schritt weiter.
Mein Logfile sieht jetzt folgendermaßen aus:
04.07.2020 11:34:13 - System - Info - Geting system parameters
04.07.2020 11:34:13 - System - Info - Certificate Assistant Exchange 2010 Version
04.07.2020 11:34:13 - System - Info - PowerShell Version: 5.1.14409.1018 OSVersion: 6.1.7601.65536
04.07.2020 11:34:13 - Check Posh-ACME - Info - Check if Module installed
04.07.2020 11:34:13 - Check Posh-ACME - Warning - Posh-ACME not installed, try to install it
04.07.2020 11:34:13 - Check Posh-ACME - Info - Using legacy installation method
04.07.2020 11:34:13 - Check Posh-ACME - Info - Try to download PackageManagement-MSI Path: C:\Users\xx\Documents\Zertifikate\Lets_Encrypt\poshacme.zip
04.07.2020 11:34:14 - Check Posh-ACME - Error - Installation failed or arborted
04.07.2020 11:34:14 - Load Posh-ACME - Info - Posh-ACME is installed, try to load it
04.07.2020 11:34:17 - Load Posh-ACME - Info - Module Import was successfull, PoshACMEVersion 0.0
04.07.2020 11:34:17 - Load Exchange SnapIns - Info - Try to load Exchange SnapIns
04.07.2020 11:34:19 - Load Exchange SnapIns - Info - Sucessfully loaded Exchange SnapIns
04.07.2020 11:34:19 - IIS - Info - Trying to create .Well-Known Directory
04.07.2020 11:34:20 - IIS - Info - Well-Known Folder already exists, skipping
04.07.2020 11:34:20 - IIS - Info - Added Mime Type to Well-Known Folder
04.07.2020 11:34:20 - IIS - Info - Changing Let's Encrypt IIS directory to http
04.07.2020 11:34:21 - IIS - Info - Successfully changed Let's Encrypt IIS directory to http
04.07.2020 11:34:21 - IIS - Info - Checking Let's Encrypt IIS directory to accept validation by http request
04.07.2020 11:34:21 - IIS - Info - .well-known directory accepts http
04.07.2020 11:34:21 - Custom FQDNs - Info - Using Custom FQDNs is configured
04.07.2020 11:34:21 - LE System - Info - Setting LE Mode
04.07.2020 11:34:21 - LE System - Info - Setting LE Mode to PRODUCTION MODE (LIVE SYSTEM)
04.07.2020 11:34:21 - LE System - Info - Checking for existing LE Account
04.07.2020 11:34:21 - LE System - Info - Found a existing LE Account
04.07.2020 11:34:21 - LE Certificate - Info - Trying to create a new order for a certificate
04.07.2020 11:34:37 - LE Certificate - Info - Successfully ordered certificate
04.07.2020 11:34:37 - LE System - Info - Creating Autorisation files for LE verification
04.07.2020 11:34:38 - LE System - Info - Asking LE to verify the order
04.07.2020 11:34:39 - LE System - Info - Successfully informed LE to verify the order
04.07.2020 11:34:39 - LE System - INFO - Let's give LE some time to validate (1 min)
04.07.2020 11:35:39 - LE System - INFO - Time to wake up, need coffee!
04.07.2020 11:35:39 - LE System - INFO - Let's check the authorization
04.07.2020 11:35:40 - LE System - INFO - Authorization for autodiscover.domainA.at is valid
04.07.2020 11:35:40 - LE System - INFO - Authorization for graz.int.domainA.at is valid
04.07.2020 11:35:40 - LE System - INFO - Authorization for graz.DomainA.at is valid
04.07.2020 11:35:40 - LE System - INFO - Authorization for autodiscover.DomainB.com is valid
04.07.2020 11:35:40 - LE System - INFO - Let's refresh the order
04.07.2020 11:35:40 - LE System - INFO - Let's check if order is ready
04.07.2020 11:35:40 - LE System - INFO - Order is ready
04.07.2020 11:35:40 - LE System - INFO - Let's get the certificate
04.07.2020 11:35:41 - LE System - ERROR - Getting certificate was not successfull
get-paorder | Get-PAAuthorizations
liefert mir folgendes:
identifier : @{type=dns; value=autodiscover.DomainA.at}
status : valid
expires : 2020-08-02T22:36:35Z
challenges : {@{type=http-01; status=valid; url= https://acme-v02.api.letsencrypt.org/acme/chall-v3/5647864817/zWRu6A;
token=uEONWqbLsztrML-dQIGMmT-3Skb696Wf2quZLKF8jGg; validationRecord=System.Object[]}}
DNSId : autodiscover.DomainA.at
fqdn : autodiscover.DomainA.at
location : https://acme-v02.api.letsencrypt.org/acme/authz-v3/5647864817
DNS01Status :
DNS01Url :
DNS01Token :
HTTP01Status : valid
HTTP01Url : https://acme-v02.api.letsencrypt.org/acme/chall-v3/5647864817/zWRu6A
HTTP01Token : uEONWqbLsztrML-dQIGMmT-3Skb696Wf2quZLKF8jGg
identifier : @{type=dns; value=graz.int.DomainA.at}
status : valid
expires : 2020-08-02T22:36:35Z
challenges : {@{type=http-01; status=valid; url= https://acme-v02.api.letsencrypt.org/acme/chall-v3/5647864818/78K5Ig;
token=efEwPgSUvG6VuaIev4I4Or70wD_jhw5jIkqzTNVPHyI; validationRecord=System.Object[]}}
DNSId : graz.int.DomainA.at
fqdn : graz.int.DomainA.at
location : https://acme-v02.api.letsencrypt.org/acme/authz-v3/5647864818
DNS01Status :
DNS01Url :
DNS01Token :
HTTP01Status : valid
HTTP01Url : https://acme-v02.api.letsencrypt.org/acme/chall-v3/5647864818/78K5Ig
HTTP01Token : efEwPgSUvG6VuaIev4I4Or70wD_jhw5jIkqzTNVPHyI
identifier : @{type=dns; value=graz.DomainA.at}
status : valid
expires : 2020-08-02T22:36:35Z
challenges : {@{type=http-01; status=valid; url= https://acme-v02.api.letsencrypt.org/acme/chall-v3/5647864819/7DjDqA;
token=5dIUnvpQNSETFC6wLwxxpLUl1i89BYhllvvuV8cX8jU; validationRecord=System.Object[]}}
DNSId : graz.DomainA.at
fqdn : graz.DomainA.at
location : https://acme-v02.api.letsencrypt.org/acme/authz-v3/5647864819
DNS01Status :
DNS01Url :
DNS01Token :
HTTP01Status : valid
HTTP01Url : https://acme-v02.api.letsencrypt.org/acme/chall-v3/5647864819/7DjDqA
HTTP01Token : 5dIUnvpQNSETFC6wLwxxpLUl1i89BYhllvvuV8cX8jU
identifier : @{type=dns; value=autodiscover.DomainB.com}
status : valid
expires : 2020-08-02T22:36:35Z
challenges : {@{type=http-01; status=valid; url= https://acme-v02.api.letsencrypt.org/acme/chall-v3/5647864816/AhRhZw;
token=DC7z6WQkJgxSTJOii4WyD2kOgcmaKlSQ5zYQA_TY-og; validationRecord=System.Object[]}}
DNSId : autodiscover.DomainB.com
fqdn : autodiscover.DomainB.com
location : https://acme-v02.api.letsencrypt.org/acme/authz-v3/5647864816
DNS01Status :
DNS01Url :
DNS01Token :
HTTP01Status : valid
HTTP01Url : https://acme-v02.api.letsencrypt.org/acme/chall-v3/5647864816/AhRhZw
HTTP01Token : DC7z6WQkJgxSTJOii4WyD2kOgcmaKlSQ5zYQA_TY-og
Zur Info:
Folgende Änderung hatte ich schon in der v2 auf Empfehlung von Frank gemacht
Zeile 45
#$CustomFQDNs = @("servername.domain.tld","server2.domain.tld")
$CustomFQDNs = @("autodiscover.DomainA.at","graz.int.DomainA.at", "graz.DomainA.at", "autodiscover.DomainB.com" )
Ich hoffe Ihr könnt mir da weiterhelfen.
Gruß Markus
Themenstarter 4. Juli 2020 21:13
Ergänzung:
get-paorder | fl
liefert mir
status : ready
expires : 2020-07-11T09:34:36Z
identifiers : {System.Collections.Hashtable, System.Collections.Hashtable, System.Collections.Hashtable, System.Collections.Hashtable}
authorizations : { https://acme-v02.api.letsencrypt.org/acme/authz-v3/5647864817,
https://acme-v02.api.letsencrypt.org/acme/authz-v3/5647864818,
https://acme-v02.api.letsencrypt.org/acme/authz-v3/5647864819,
https://acme-v02.api.letsencrypt.org/acme/authz-v3/5647864816}
finalize : https://acme-v02.api.letsencrypt.org/acme/finalize/87577907/4049067022
MainDomain : autodiscover.DomainA.at
SANs : {graz.int.DomainA.at, graz.DomainA.at, autodiscover.DomainB.com}
KeyLength : 2048
CertExpires :
RenewAfter :
OCSPMustStaple : False
DnsPlugin : {Manual}
DnsAlias :
DnsSleep : 120
ValidationTimeout : 60
FriendlyName : autodiscover.DomainA.at
PfxPass : saF4§2kLcdf&dsXS27
Install : False
certificate :
location : https://acme-v02.api.letsencrypt.org/acme/order/87577907/4049067022
Themenstarter 5. Juli 2020 20:04
Habe es lösen können.
Folgende Sachen habe ich gemacht:
CA_v3_EX2010
$WebsitePath = (Get-Website "Default Web Site").PhysicalPath
durch
$Websitepath = (Get-Website *"Default Web Site"*).physicalPath
bzw. letztendlich durch
$WebsitePath = (Get-Website | Where-Object {$_.Name -eq „Default Web Site“}).PhysicalPath
ersetzt.
Die 3 Zeilen mit $IISMimeType habe ich auskommentiert.
C:\inetpub\wwwroot\.well-known\acme-challenge\web.config
<mimeMap fileExtension="." mimeType="text/json" /> gelöscht
Install-Module -Name Posh-ACME
händisch ausgeführt.
Was jetzt davon zwingend notwendig war kann ich nicht sagen.
Nach der händischen Installation von Posh-ACME lief das Skript durch und das Zertifikat wurde erstellt.