Microsoft Windows (PowerShell)¶

Tip

Before you begin, verify that the machine is created in Certificate Manager - SaaS and that you completed the prerequisite configuration steps.

PowerShell script signing requirement

The PowerShell connector requires that you set the execution policy to AllSigned on the target machine. Only signed scripts can run.

If unsigned scripts prevent you from enabling AllSigned globally, set the execution policy to AllSigned for the service account only.

Sign in to Certificate Manager - SaaS.
Select Installations > Machines.
Click the more options button at the right end of the Microsoft Windows (PowerShell) machine's row, and then select Provision.
In Choose a certificate from the inventory, search for and select the certificate to provision. Review its Subject DN, Validity, and Fingerprint to confirm accuracy.
In CAPI Store, select the certificate store to install the certificate.
Enter a Friendly Name for the certificate.
Optional: To enable export of the certificate's private key, select Allow private key to be exported.

Optional: To automatically run the PowerShell script, select Installation Endpoint.

Note

When you enable Installation Endpoint, the PowerShell script runs to bind the provisioned certificate to Windows services. The script runs under the machine's configured service account, which also installs the certificate into the CAPI store.

Note

Your PowerShell script must include a bind-certificate function that accepts certificateStore and thumbprint parameters. The function runs automatically when you provision a certificate.

Script signing requirements

Import the CyberArk code signing certificate to the Trusted Publishers certificate store.
Import your code signing certificate to the Trusted Publishers certificate store.
Sign your PowerShell script with both certificates.
Set the execution policy to AllSigned for the service account.

CyberArk code signing certificate

Certificate Manager - SaaS uses PowerShell scripts over WinRM to provision certificates. These scripts are signed with a DigiCert code signing certificate issued to CyberArk Software Ltd. You must import this certificate into the Trusted Publishers certificate store in the machine's CAPI store.

Typically, your Active Directory administrators manage and distribute trusted publisher certificates through Group Policy.

The certificate is available in PEM format:

Warning

You're responsible for securing your PowerShell script. Use a dedicated service account with the minimum required permissions. Don't use an admin or shared account. Script signing ensures integrity after deployment but doesn't guarantee source security.

Example

<##################
.NAME
    bind-certificate
.DESCRIPTION
    Consumes a certificate from the CAPI store to bind the certificate to a Windows service
.PARAMETER certificateStore
    The Windows certificate store location where the certificate is stored
.PARAMETER thumbprint
    The public key hash of the certificate
.NOTES
    Successful script execution returns exit code 0. If the script fails, it returns a non-zero exit code,
    and Certificate Manager - SaaS displays the error message in the UI.
##################>
function bind-certificate( [string]$certificateStore, [string]$thumbprint )
{
    return "Success"
}

In Script Path, enter the full path to the PowerShell script.

Tip

When you enable Installation Endpoint, the certificate is pushed to the script at this path when you save.
Optional: To create the certificate without pushing it to the Windows certificate store, set Push upon saving to No.
Select Save.

Want to schedule your provisions?

Schedule your provisions daily, weekly, or monthly. Learn more