spencerm/PacketStation
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

scripts: Request-VsqlServerCertificate.ps1 requests and installs a SQL Server TLS certificate from PESCO-PSYLOCKE-CA
ci / frontend (push) Successful in 42s
Details
ci / server (push) Successful in 11m13s
Details
ci / image (push) Successful in 13s
Details
ci / e2e (push) Failing after 3m50s
Details

Browse Source 
Co-Authored-By: Claude Fable 5.1 <[email protected]>
This commit is contained in:
spencerm
2026-10-18 21:15:49 -06:00
co-authored by Claude Fable 5.1
parent b420f77410
commit fdfb8ae40f
2 changed files with 185 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/README.md
+4
View File
@@ -6,3 +6,7 @@ systemd timer on docker-1, and a restore script with a rehearsal recorded in doc
## Export-PescoCaBundle.ps1
Run on a domain-joined PC. Exports every unexpired PESCO CA certificate from the Windows stores to one PEM bundle and copies it to docker-1 with scp (default target `~/packetstation/test/ca/pesco-ca.pem`). Use `-Remote` for another path and `-NoCopy` to only write the file. It warns on SHA-1 signed certificates; see docs/DEPLOY.md.
## Request-VsqlServerCertificate.ps1
Run elevated on the SQL Server host behind vsql. Requests a TLS certificate from PESCO-PSYLOCKE-CA with certreq (RSA 2048, SHA-256, Server Authentication, SANs vsql.pesco.com, vsql and the host names, Key Storage Provider, exportable), installs it, grants the SQL Server service accounts read on the private key, points each instance at it, and prints or performs the restarts. `-WhatIf` shows the steps. Gitea issue 5 tracks the switch to `VISUAL_ENCRYPT=yes`.