1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
|
# Copyright (c) Microsoft Corporation. All rights reserved.
# Licensed under the MIT License.
# IMPORTANT: Do not invoke this file directly. Please instead run eng/New-TestResources.ps1 from the repository root.
#Requires -Version 6.0
#Requires -PSEdition Core
using namespace System.Security.Cryptography
using namespace System.Security.Cryptography.X509Certificates
# Use same parameter names as declared in eng/New-TestResources.ps1 (assume validation therein).
[CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'Medium')]
param (
# Captures any arguments from eng/New-TestResources.ps1 not declared here (no parameter errors).
[Parameter(ValueFromRemainingArguments = $true)]
$RemainingArguments
)
$ServiceRegionMap = @{
"east asia" = "EastAsia";
"southeast asia" = "SoutheastAsia";
"east us" = "EastUS";
"east us 2" = "EastUS2";
"west us" = "WestUS";
"west us 2" = "WestUS2";
"central us" = "CentralUS";
"north central us" = "NorthCentralUS";
"south central us" = "SouthCentralUS";
"north europe" = "NorthEurope";
"west europe" = "WestEurope";
"japan east" = "JapanEast";
"japan west" = "JapanWest";
"brazil south" = "BrazilSouth";
"australia east" = "AustraliaEast";
"australia southeast" = "AustraliaSoutheast";
"central india" = "CentralIndia";
"south india" = "SouthIndia";
"west india" = "WestIndia";
"china east" = "ChinaEast";
"china north" = "ChinaNorth";
"us gov iowa" = "USGovIowa";
"usgov virginia" = "USGovVirginia";
"germany central" = "GermanyCentral";
"germany northeast" = "GermanyNortheast";
"uk south" = "UKSouth";
"canada east" = "CanadaEast";
"canada central" = "CanadaCentral";
"canada west" = "CanadaWest";
"central us euap" = "CentralUSEUAP";
}
$AbbreviatedRegionMap = @{
"eastasia" = "easia";
"southeastasia" = "sasia";
"eastus" = "eus";
"eastus2" = "eus2";
"westus" = "wus";
"westus2" = "wus2";
"centralus" = "cus";
"northcentralus" = "ncus";
"southcentralus" = "scus";
"northeurope" = "neu";
"westeurope" = "weu";
"japaneast" = "ejp";
"japanwest" = "wjp";
"brazilsouth" = "sbr";
"australiaeast" = "eau";
"australiasoutheast" = "sau";
"centralindia" = "cin";
"southindia" = "sin";
"westindia" = "win";
"chinaeast" = "ecn";
"chinanorth" = "ncn";
"usgoviowa" = "iusg";
"usgovvirginia" = "vusg";
"germanycentral" = "cde";
"germanynortheast" = "nde";
"uksouth" = "uks";
"canadaeast" = "cae";
"canadacentral" = "cac";
"canadawest" = "caw";
"centraluseuap" = "cuse";
}
# By default stop for any error.
if (!$PSBoundParameters.ContainsKey('ErrorAction')) {
$ErrorActionPreference = 'Stop'
}
function Log($Message) {
Write-Host ('{0} - {1}' -f [DateTime]::Now.ToLongTimeString(), $Message)
}
function New-X509Certificate2([RSA] $rsa, [string] $SubjectName) {
try {
$req = [CertificateRequest]::new(
[string] $SubjectName,
$rsa,
[HashAlgorithmName]::SHA256,
[RSASignaturePadding]::Pkcs1
)
# TODO: Add any KUs necessary to $req.CertificateExtensions
$req.CertificateExtensions.Add([X509BasicConstraintsExtension]::new($true, $false, 0, $false))
$NotBefore = [DateTimeOffset]::Now.AddDays(-1)
$NotAfter = $NotBefore.AddDays(365)
$req.CreateSelfSigned($NotBefore, $NotAfter)
}
finally {
}
}
function Export-X509Certificate2([string] $Path, [X509Certificate2] $Certificate) {
$Certificate.Export([X509ContentType]::Pfx) | Set-Content $Path -AsByteStream
}
function Export-X509Certificate2PEM([string] $Path, [X509Certificate2] $Certificate) {
@"
-----BEGIN CERTIFICATE-----
$([Convert]::ToBase64String($Certificate.RawData, 'InsertLineBreaks'))
-----END CERTIFICATE-----
"@ > $Path
}
Log "Running PreConfig script".
$shortLocation = $AbbreviatedRegionMap.Get_Item($Location.ToLower())
Log "Mapped long location name ${Location} to short name: ${shortLocation}"
try {
$isolatedKey = [RSA]::Create(2048)
$isolatedCertificate = New-X509Certificate2 $isolatedKey "CN=AttestationIsolatedManagementCertificate"
$EnvironmentVariables["ATTESTATION_ISOLATED_SIGNING_CERTIFICATE"] = $([Convert]::ToBase64String($isolatedCertificate.RawData, 'None'))
$templateFileParameters.isolatedSigningCertificate = $([Convert]::ToBase64String($isolatedCertificate.RawData, 'None'))
$EnvironmentVariables["ATTESTATION_ISOLATED_SIGNING_KEY"] = $([Convert]::ToBase64String($isolatedKey.ExportPkcs8PrivateKey()))
$EnvironmentVariables["ATTESTATION_SERIALIZED_ISOLATED_SIGNING_KEY"] = $isolatedKey.ToXmlString($True)
}
finally {
$isolatedKey.Dispose()
}
$EnvironmentVariables["ATTESTATION_LOCATION_SHORT_NAME"] = $shortLocation
$templateFileParameters.locationShortName = $shortLocation
Log 'Creating 3 X509 certificates which can be used to sign policies.'
$wrappingFiles = foreach ($i in 0..2) {
try {
$certificateKey = [RSA]::Create(2048)
$certificate = New-X509Certificate2 $certificateKey "CN=AttestationCertificate$i"
$EnvironmentVariables["ATTESTATION_POLICY_SIGNING_CERTIFICATE$i"] = $([Convert]::ToBase64String($certificate.RawData))
$EnvironmentVariables["ATTESTATION_POLICY_SIGNING_KEY$i"] = $([Convert]::ToBase64String($certificateKey.ExportPkcs8PrivateKey()))
$EnvironmentVariables["ATTESTATION_SERIALIZED_POLICY_SIGNING_KEY$i"] = $certificateKey.ToXmlString($True)
$baseName = "$PSScriptRoot\attestation-certificate$i"
Export-X509Certificate2 "$baseName.pfx" $certificate
}
finally {
$certificateKey.Dispose()
}
}
|
