Hi James,
I am assuming this is a bug with the New-NcSecurityCertificateCsr CmdLet. I have raised this with the developers for you. In the interim as a workaround for you I've developed a Function Wrapper around the "security/certificate-signing-request" REST API for you. I've tested this and validated it does return the private key, also i've tested it to validate that the REST API does indeed not require all subject alternative fields (dns, email, ip, url). Please see the example code below:
Param(
[Parameter(Mandatory = $True, HelpMessage = "The cluster name, FQDN or IP Address")]
[ValidateNotNullOrEmpty()]
[String]$Cluster,
[Parameter(Mandatory = $False, HelpMessage = "The Asymmetric Encryption Algorithm")]
[ValidateSet("rsa", "ecc")]
[String]$Algorithm="rsa",
[Parameter(Mandatory = $True, HelpMessage = "The extended key usage extension")]
[ValidateSet("serverauth", "clientauth", "timestamping", "anyextendedkeyusage", "critical")]
[Array]$ExtendedKeyUsage,
[Parameter(Mandatory = $False, HelpMessage = "The Hashing function")]
[ValidateSet("sha256", "sha224", "sha384", "sha512")]
[String]$HashFunction="sha256",
[Parameter(Mandatory = $True, HelpMessage = "The Key Usage")]
[ValidateSet("digitalsignature", "nonrepudiation", "keyencipherment", "dataencipherment", "keyagreement", "keycertsign", "crlsign", "encipheronly", "decipheronly", "critica")]
[Array]$KeyUsage,
[Parameter(Mandatory = $False, HelpMessage = "The Security Strength")]
[ValidateSet(112, 128, 192)]
[Int]$SecurityStrength=112,
[Parameter(Mandatory = $False, HelpMessage = "An Array of DNS names for Subject Alternate name extension")]
[Array]$Dns,
[Parameter(Mandatory = $False, HelpMessage = "An Array of Email Addresses for Subject Alternate name extension")]
[Array]$EmailAddress,
[Parameter(Mandatory = $False, HelpMessage = "An Array of IP Addresses for Subject Alternate name extension")]
[Array]$IPAddress,
[Parameter(Mandatory = $False, HelpMessage = "An Array of URL's for Subject Alternate name extension")]
[Array]$Url,
[Parameter(Mandatory = $True, HelpMessage = "The Subject Name. EG 'CN=engineering.netapp.com'")]
[String]$SubjectName,
[Parameter(Mandatory = $True, HelpMessage = "The Credential to authenticate to the cluster")]
[ValidateNotNullOrEmpty()]
[System.Management.Automation.PSCredential]$Credential
)
#'------------------------------------------------------------------------------
Function New-NcSecurityCsr{
[CmdletBinding()]
Param(
[Parameter(Mandatory = $True, HelpMessage = "The cluster name, FQDN or IP Address")]
[ValidateNotNullOrEmpty()]
[String]$Cluster,
[Parameter(Mandatory = $False, HelpMessage = "The Asymmetric Encryption Algorithm")]
[ValidateSet("rsa", "ecc")]
[String]$Algorithm="rsa",
[Parameter(Mandatory = $True, HelpMessage = "The extended key usage extension")]
[ValidateSet("serverauth", "clientauth", "timestamping", "anyextendedkeyusage", "critical")]
[Array]$ExtendedKeyUsage,
[Parameter(Mandatory = $False, HelpMessage = "The Hashing function")]
[ValidateSet("sha256", "sha224", "sha384", "sha512")]
[String]$HashFunction="sha256",
[Parameter(Mandatory = $True, HelpMessage = "The Key Usage")]
[ValidateSet("digitalsignature", "nonrepudiation", "keyencipherment", "dataencipherment", "keyagreement", "keycertsign", "crlsign", "encipheronly", "decipheronly", "critica")]
[Array]$KeyUsage,
[Parameter(Mandatory = $True, HelpMessage = "The Security Strength")]
[ValidateSet(112, 128, 192)]
[Int]$SecurityStrength,
[Parameter(Mandatory = $False, HelpMessage = "An Array of DNS names for Subject Alternate name extension")]
[Array]$Dns,
[Parameter(Mandatory = $False, HelpMessage = "An Array of Email Addresses for Subject Alternate name extension")]
[Array]$EmailAddress,
[Parameter(Mandatory = $False, HelpMessage = "An Array of IP Addresses for Subject Alternate name extension")]
[Array]$IPAddress,
[Parameter(Mandatory = $False, HelpMessage = "An Array of URL's for Subject Alternate name extension")]
[Array]$Url,
[Parameter(Mandatory = $True, HelpMessage = "The Subject Name. EG 'CN=engineering.netapp.com'")]
[String]$SubjectName,
[Parameter(Mandatory = $True, HelpMessage = "The Credential to authenticate to the cluster")]
[ValidateNotNullOrEmpty()]
[System.Management.Automation.PSCredential]$Credential
)
#'---------------------------------------------------------------------------
#'Set the authentication header to connect to AIQUM.
#'---------------------------------------------------------------------------
$auth = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($Credential.UserName + ':' + $Credential.GetNetworkCredential().Password))
$headers = @{
"Authorization" = "Basic $auth"
"Accept" = "application/json"
"Content-Type" = "application/json"
}
#'---------------------------------------------------------------------------
#'Set the JSON body to create the CSR.
#'---------------------------------------------------------------------------
[String]$uri = "https://$Cluster/api/security/certificate-signing-request"
$csr = @{};
$csr.Add("algorithm", $Algorithm)
$csr.Add("extended_key_usages", $ExtendedKeyUsage)
$csr.Add("hash_function", $HashFunction)
$csr.Add("key_usages", $KeyUsage)
$csr.Add("security_strength", $SecurityStrength)
$SubjectAlternatives = @{};
$sa = $False
If($Dns){
$SubjectAlternatives.Add("dns", $Dns)
$sa = $True
}
If($EmailAddress){
$SubjectAlternatives.Add("email", $EmailAddress)
$sa = $True
}
If($IPAddress){
$SubjectAlternatives.Add("ip", $IPAddress)
$sa = $True
}
If($Url){
$SubjectAlternatives.Add("url", $Url)
$sa = $True
}
If($sa){
$csr.Add("subject_alternatives", $SubjectAlternatives)
}
$csr.Add("subject_name", $SubjectName)
$body = $csr | ConvertTo-Json
#'---------------------------------------------------------------------------
#'Create the CSR.
#'---------------------------------------------------------------------------
Try{
$response = Invoke-RestMethod -Uri $uri -Method POST -Body $body -Headers $headers -ErrorAction Stop
Write-Host "Created CSR on cluster ""$Cluster"" using URI ""$uri"""
}Catch{
Write-Warning -Message $("Failed creating CSR on Cluster ""$Cluster"" using URI ""$uri"". Error " + $_.Exception.Message + ". Status Code " + $_.Exception.Response.StatusCode.value__)
}
Return $response;
}#'End Function New-NcSecurityCsr.
#'------------------------------------------------------------------------------
#'Set the command to create the CSR.
#'------------------------------------------------------------------------------
[String]$command = "New-NcSecurityCsr -Cluster $Cluster "
If($Algorithm){
[String]$command += "-Algorithm $Algorithm "
}
If($ExtendedKeyUsage){
[String]$command += "-ExtendedKeyUsage $ExtendedKeyUsage "
}
If($HashFunction){
[String]$command += "-HashFunction $HashFunction "
}
[String]$command += "-KeyUsage $KeyUsage -SecurityStrength $SecurityStrength "
If($Dns){
[String]$command += "-Dns $Dns "
}
If($EmailAddress){
[String]$command += "-EmailAddress $EmailAddress "
}
If($IPAddress){
[String]$command += "-IPAddress $IPAddress "
}
If($Url){
[String]$command += "-Url $Url "
}
[String]$command += "-SubjectName $SubjectName -Credential `$Credential -ErrorAction Stop"
#'------------------------------------------------------------------------------
#'Create the CSR.
#'------------------------------------------------------------------------------
Try{
$response = Invoke-Expression -Command $command -ErrorAction Stop
Write-Host "Executed Command`: $command"
}Catch{
Write-Warning -Message $("Failed Executing Command`: $command. Error " + $_.Exception.Message + ". Status Code " + $_.Exception.Response.StatusCode.value__)
Break;
}
$response
$response | fl
#'------------------------------------------------------------------------------
Example output:
PS C:\Scripts\PowerShell\Projects\ONTAP\CreateSecurityCsr> .\CreateSecurityCsr.ps1 -Cluster cluster1.testlab.local -Algorithm rsa -ExtendedKeyUsage serverauth -HashFunction sha256 -KeyUsage digitalsignature -SecurityStrength 1
92 -Dns *.testlab.local -EmailAddress admin@testlab.local -IPAddress 192.168.100.100 -SubjectName CN=vserver1.testlab.local -Credential $credential
Created CSR on cluster "cluster1.testlab.local" using URI "https://cluster1.testlab.local/api/security/certificate-signing-request"
Executed Command: New-NcSecurityCsr -Cluster cluster1.testlab.local -Algorithm rsa -ExtendedKeyUsage serverauth -HashFunction sha256 -KeyUsage digitalsignature -SecurityStrength 192 -Dns *.testlab.local -EmailAddress admin@tes
tlab.local -IPAddress 192.168.100.100 -SubjectName CN=vserver1.testlab.local -Credential $Credential -ErrorAction Stop
csr
---
-----BEGIN CERTIFICATE REQUEST-----...
csr : -----BEGIN CERTIFICATE REQUEST-----
MIIE0zCCArsCAQAwITEfMB0GA1UEAxMWdnNlcnZlcjEudGVzdGxhYi5sb2NhbDCC
<redacted text>
nwUaiPwsVagdQOkhF2WpV6vscnvCO7tLgUMg5+1U1Fgbg4wP0fR4
-----END CERTIFICATE REQUEST-----
generated_private_key : -----BEGIN PRIVATE KEY-----
MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQCiPMoYhHDLR9vS
<redacted text>
DIgPtGqQrSP4LK1Lkp1JutmtJG6r
-----END PRIVATE KEY-----
Hope that helps until the issue is resolved?
/Matt
If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.
