Hello everyone, I have been thrown into VBScripting, of which I have no
experience.
I need to come up with a script that will revoke a certificate.
Specifically I need to revoke certificates from my CA that belong to certain
servers.
I am pretty sure I can figure out how to write a script that will call the
CertUtil utility and revoke the cert by serial number (based on the
following).
To revoke the certificate by serial number
Syntax
certutil-revoke [-gmt] [-seconds] [-v] [-config CAMachineName\CAName]
SerialNumber [Reason]
What I am stuck on is how to either scan through my CA and obtain the serial
numbers in question, or query the servers directly for the SN of their Cert.
Then use that list of serial numbers to revoke each. The good news is that
all of the servers I will have to do this for have a common naming
convention. Let's just say for example they all begin with AServer. .
Aserver1, AServer2, etc.
Here is some more information specific to what I am trying to accomplish:
I can easily do it through the GUI, but not sure how to script it.
We have member servers in a Windows 2003 domain with Microsoft Certificate
Authorities, Root, Intermediate, Issuing all set up with Group Policy set up
to manage. We are going through and changing the names of certain servers.
Then we are running an executable that forces the renamed client machine to
request a new certificate. That leaves the old certificate sitting on the CA
with the old machine name. I need to be able to script out finding that cert
on the CA under "Issued Certificates" and revoke it. It is easy enough if
you are in the GUI, just look and find the old server name and look at the
issued date and right click and revoke.
So I need a way to either go through all certs on the CA and parse for the
old hostname and retrieve the SN so it can be revoked. Or maybe there is a
way to query the member server for the previous cert. I have looked at the
Certutil switches and cannot find a way to pull the serial numbers at all,
much less pull a specific one based on member server name.
I shouldn't be a complete novice for long, as I am sitting at my desk going
through my courseware for both 2433A and 2439A. I have a deadline on the
above however and would really appreciate any help at all.
Thank you very much
--
Brad