If you need to specify credentials in a DSC resource and don’t want it to be stored in plain text (you don’t!) you need to encrypt it using the public key of a certificate. That overall process is described here, it is also shown in module 6 of the Getting Started with PowerShell Desired State Configuration (DSC) MVA event.

What I want to address with this post is the process of obtaining the public key and thumbprint of the certificate used for encryption. A lot of examples I’ve seen are following the basic concept of retrieving the certificate from the local server where the mof will be deployed, but that requires firewall openings to all servers and credentials to them, and I think this might be a better/simpler alternative to that, at least in some cases.

So I’ve written a function (link at the bottom of this post) that gets the information needed straight from a Microsoft Certificate Authority (aka Active Directory Certificate Services) instead of all the different servers, which I think simplifies the process a bit.

I’ve also added some other properties to the returned objects to make it possible to use this advanced function for monitoring expiring certificates.

I’ll give you some examples on how to use this function below!

I’d also like to point out that I found a lot of parts of this code on the internet, I’ve just added a few extra things to it and wrapped it in an advanced function. I’m not sure who is the original author of this code though, if anyone knows, please add a comment below so I can give credit where credit is due! Thanks to whoever you are! 🙂

So, the process itself is pretty straight forward, specify your CA instance and what certificates you are interested in and the function will return them for you. You could for example do this:

PS> Get-CACertificateDatabase -CertificationAuthority "contoso.com\Issuing CA" -IncludeBinaryCertificate

All issued certificates valid today and up to two years ahead will be returned, including their public key. To save them all to disk you could do this:

PS> Get-CACertificateDatabase -CertificationAuthority "contoso.com\Issuing CA" -IncludeBinaryCertificate | ForEach-Object { $_.BinaryCertificate | Out-File "$($_.IssuedCommonName).cer" -Encoding default }

You might want to filter the returned certificates on the template you use for encrypting credentials in DSC if you don’t want all your certificates saved locally.

I hope someone might find this useful! If you need help getting started with DSC, check the links at the top of this post.

The code for this function as been uploaded here.