Microsoft Windows (PowerShell)¶

Tip

Before proceeding, verify that the machine is already created in TLS Protect Cloud. Also, ensure that you’ve completed the prerequisite configuration steps for the Microsoft Windows (PowerShell) machine.

In the TLS Protect Cloud toolbar, click Machines.
Click the checkbox next to the Microsoft Windows (PowerShell) machine that you want to provision a certificate to.
Click Provision a certificate. The Provision a certificate modal opens.
From the Choose a certificate from the inventory field, begin typing the certificate name you want to provision. Click the certificate when you see it listed.

Verify that you've selected the correct certificate by reviewing the Subject DN, Validity, and Fingerprint.
From the CAPI Store drop down, select the certificate store you want the certificate installed in.
Enter a Friendly Name for this certificate in the Windows Certificate Store.
If you want the private key associated with this certificate to be able to be exported from the Windows certificate store, toggle the Allow private key to be exported option.
(Optional) To automatically invoke the PowerShell script function, enable the Installation Endpoint toggle in TLS Protect Cloud.

Note

Enabling Installation Endpoint allows you to execute your provided PowerShell script to consume the provisioned certificate to different Windows services. The PowerShell script is executed with the account configured on the TLS Protect Cloud Microsoft Windows (PowerShell) machine. This account is also used to install the certificate into the CAPI store.
Note

Ensure that the PowerShell script configured on the Microsoft Windows (PowerShell) machine is managed and written to execute your intended actions, not exhaust system resources, and sign with a trusted certificate on the target system. The script must contain a specific function that would be executed to consume (bind) the certificate from the CAPI store.

Warning

You are responsible for managing, writing, and securing your PowerShell script. To minimize exposure and prevent unauthorized access, use a dedicated user account with only the necessary permissions (least privilege) instead of an admin or shared account, as a compromised script with broad access increases security risks. Script signing ensures integrity after deployment but does not gaurantee the security of its source or development environment.

Refer to the following PowerShell script example:
```
<##################
.NAME
    bind-certificate
.DESCRIPTION
    consumes a certificate from the CAPI store, mainly used to bind the certificate to a Windows service
.PARAMETER certificateStore
    The Windows Certificates store location where the certificate is stored
.PARAMETER thumbprint
    A text string that represents the public key hash of the certificate
.NOTES
    A successful script execution returns an exit code 0. If the script fails, it returns a non-zero exit code
    and TLS Protect Cloud would show the error message in the UI
##################>
function bind-certificate( [string]$certificateStore, [string]$thumbprint )
{
    return "Success"
}
```
1. In the Script Path box, enter the full path to the PowerShell script.
To create the certificate in TLS Protect Cloud without pushing it, set the Push upon saving slider to No.

With the default Yes, saving pushes the certificate to the Windows certificate store. If the Installation Endpoint is configured (see previous step), it also pushes the certificate to the Microsoft Windows (PowerShell) script specified in the Script Path.

Click Save.

Want to schedule your provisions?

Schedule your provisions daily, weekly, or monthly. Learn more

Are you requiring strict enforcement of Powershell script signing?

Yes, strict enforcement of PowerShell script signing is required. You are responsible for managing, writing, and securing your PowerShell script to execute your intended actions.

The Microsoft Windows (PowerShell) Server provisioning process is used over WinRM to install certificates on the Windows machine. TLS Protect Cloud PowerShell scripts are signed using Venafi's DigiCert CodeSigning certificate. Your custom PowerShell script must be signed by a Trusted Publisher. Ensure Venafi's CodeSigning certificate is included of the Trusted Publishers location on the machine's CAPI store. The script will not be executed and the certificate will fail to provision if the script is not signed, or if strict signing requirements are not enabled. Typically, this is managed and distributed via Group Policy by your Active Directory administrators.

Warning

TLS Protect Cloud ensures the ExecutionPolicy is set to AllSigned, before each execution. Modifications to your custom PowerShell scripts signing requirements will result in a provision failure.

You can find the Venafi CodeSigning certificate in PEM format for your convenience: