theInscriber / install-ca.ps1

param( [string]$CaUrl = "https://10.10.40.53", [string]$Fingerprint = "5fc8c379cab1119c1a9ac7038225f6bcf3a2ffb0e71b257af796b2bd6c71d594", [string]$StepVersion = "0.28.7", [switch]$Force ) $ErrorActionPreference = "Stop" function Write-Log { param([string]$Message) Write-Host "" Write-Host "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] $Message" } function Ensure-Step { if (Get-Command step -ErrorAction SilentlyContinue) { Write-Log "step CLI already installed" return } $msi = "step-cli_${StepVersion}_amd64.msi" $url = "https://github.com/smallstep/cli/releases/download/v${StepVersion}/${msi}" $tmp = Join-Path $env:TEMP $msi Write-Log "Downloading step CLI" Invoke-WebRequest -Uri $url -OutFile $tmp Write-Log "Installing step CLI" Start-Process msiexec.exe -Wait -ArgumentList "/i `"$tmp`" /qn" Remove-Item $tmp -Force $env:Path = [System.Environment]::GetEnvironmentVariable("Path", "Machine") + ";" + [System.Environment]::GetEnvironmentVariable("Path", "User") if (-not (Get-Command step -ErrorAction SilentlyContinue)) { throw "step CLI installation failed" } } function Bootstrap-Step { if ($Force) { $stepDir = Join-Path $HOME ".step" if (Test-Path $stepDir) { Remove-Item -Recurse -Force $stepDir } } Write-Log "Bootstrapping against $CaUrl" & step ca bootstrap --ca-url $CaUrl --fingerprint $Fingerprint --install --force } function Install-WindowsTrust { $rootCert = Join-Path $HOME ".step\certs\root_ca.crt" if (-not (Test-Path $rootCert)) { throw "Root certificate not found at $rootCert" } Write-Log "Installing root CA into Local Machine Root store" Import-Certificate -FilePath $rootCert -CertStoreLocation "Cert:\LocalMachine\Root" | Out-Null } function Verify-Install { $rootCert = Join-Path $HOME ".step\certs\root_ca.crt" Write-Log "Installed root CA:" & step certificate inspect $rootCert --short Write-Host "" Write-Host "Done." } Ensure-Step Bootstrap-Step Install-WindowsTrust Verify-Install