Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Script parameters from command line not parsed properly #1215

Closed
KononovichAI opened this issue Sep 17, 2019 · 12 comments
Closed

Script parameters from command line not parsed properly #1215

KononovichAI opened this issue Sep 17, 2019 · 12 comments
Milestone

Comments

@KononovichAI
Copy link

KononovichAI commented Sep 17, 2019

Version 2.0.10.444
IIS Version 8.5
Exchange 2013
Windows Server 2012 R2

The script does not work with Exchange 2013. I try wacs.exe --target manual --host mail.mydomain.com,autodiscover.mydomain.com --installation iis,script --installationsiteid 1 --script "./Scripts/ImportExchange.ps1" --scriptparameters "'{CertThumbprint}' 'IIS,SMTP,IMAP' '1' '{CacheFile}' '{CachePassword}' '{CertFriendlyName}'"
I receive a certificate in IIS but the script hangs for 5 minutes and fails with a timeout error. I need to use Enable-ExchangeCertuficate and etc...

@WouterTinus
Copy link
Member

Try running in --verbose mode to get some output from the script on your screen, or check the log files/event viewer for some feedback. If you don't get output anywhere then updating your version of Powershell might help.

@KononovichAI
Copy link
Author

KononovichAI commented Sep 19, 2019

I have Powershell Version 5.1.14409.1005

Full log with --verbose

C:\WACS>wacs.exe --test --verbose --target manual --host mail.antonar.by,autodis
cover.antonar.by --installation iis,script --installationsiteid 1 --script "./S
cripts/ImportExchange.ps1" --scriptparameters "'{CertThumbprint}' 'IIS,SMTP,IMAP
' '1' '{CacheFile}' '{CachePassword}' '{CertFriendlyName}'"

[INFO] A simple Windows ACMEv2 client (WACS)
[INFO] Software version 2.0.10.444 (RELEASE)
[INFO] IIS version 8.5
[WARN] Scheduled task not configured yet
[INFO] Please report issues at https://github.com/PKISharp/win-acme
[VERB] Verbose mode logging enabled
[VERB] Arguments: --test --verbose --target manual --host mail.antonar.by,autod
iscover.antonar.by --installation iis,script --installationsiteid 1 --script ./S
cripts/ImportExchange.ps1 --scriptparameters '{CertThumbprint}' 'IIS,SMTP,IMAP'
'1' '{CacheFile}' '{CachePassword}' '{CertFriendlyName}'
[VERB] Sending e-mails False
[DBUG] Renewal period: 55 days
[INFO] Running in mode: Unattended, Test
[INFO] Target generated using plugin Manual: mail.antonar.by and 1 alternatives

[WARN] Overwriting previously created renewal
[INFO] Force renewing certificate for [Manual] mail.antonar.by
[VERB] Loading ACME account signer...
[DBUG] Loading signer from C:\ProgramData\win-acme\acme-staging-v02.api.letsenc
rypt.org\Signer_v2
[VERB] Constructing ACME protocol client...
[DBUG] Send GET request to https://acme-staging-v02.api.letsencrypt.org/directo
ry
[VERB] Request completed with status OK
[DBUG] Send HEAD request to https://acme-staging-v02.api.letsencrypt.org/acme/n
ew-nonce
[VERB] Request completed with status OK
[DBUG] Loading account information from C:\ProgramData\win-acme\acme-staging-v0
2.api.letsencrypt.org\Registration_v2
[DBUG] Send POST request to https://acme-staging-v02.api.letsencrypt.org/acme/n
ew-order
[VERB] Request completed with status Created
[DBUG] Send GET request to https://acme-staging-v02.api.letsencrypt.org/acme/au
thz-v3/8654629
[VERB] Request completed with status OK
[INFO] Authorize identifier: autodiscover.antonar.by
[INFO] Authorizing autodiscover.antonar.by using http-01 validation (SelfHostin
g)
[DBUG] Submitting challenge answer
[DBUG] Send POST request to https://acme-staging-v02.api.letsencrypt.org/acme/c
hall-v3/8654629/zvajPw
[VERB] Request completed with status OK
[INFO] Authorization result: valid
[DBUG] Send GET request to https://acme-staging-v02.api.letsencrypt.org/acme/au
thz-v3/8648853
[VERB] Request completed with status OK
[INFO] Authorize identifier: mail.antonar.by
[INFO] Authorizing mail.antonar.by using http-01 validation (SelfHosting)
[DBUG] Submitting challenge answer
[DBUG] Send POST request to https://acme-staging-v02.api.letsencrypt.org/acme/c
hall-v3/8648853/6oTQhA
[VERB] Request completed with status OK
[INFO] Authorization result: valid
[DBUG] RSAKeyBits: 3072
[DBUG] Send POST request to https://acme-staging-v02.api.letsencrypt.org/acme/f
inalize/11026120/50817492
[VERB] Request completed with status OK
[INFO] Requesting certificate [Manual] mail.antonar.by
[DBUG] Certificate store: WebHosting
[INFO] Store with CertificateStore...
[INFO] Installing certificate in the certificate store
[DBUG] Opened certificate store WebHosting
[INFO] Adding certificate [Manual] mail.antonar.by 2019.9.19 8:55:45 to store W
ebHosting
[VERB] CN=mail.antonar.by - CN=Fake LE Intermediate X1 (857CEDA399F68D9FF20E1D7
C5CF7CEE8C57589A7)
[VERB] CN=Fake LE Intermediate X1 - CN=Fake LE Root X1 (4EEE7398C1A3DAF91DA1668
9DB8243927A271B9A) to CA store
[VERB] CN=Fake LE Root X1 - CN=Fake LE Root X1 (B3F73C419DAC14711F4B97192BF89C7
DEA7A7794) to AuthRoot store
[DBUG] Closing certificate stores
[INFO] Installation step 1/2: IIS...
[WARN] Our best match was the default binding and it seems there are other non-
SNI enabled bindings listening to the same endpoint, which means we cannot updat
e it without potentially causing problems. Instead, a new binding will be create
d. You may manually update the bindings if you want IIS to be configured in a di
fferent way.
[WARN] Prevent adding duplicate binding for *:443:
[INFO] Adding new https binding *:443:mail.antonar.by
[WARN] Our best match was the default binding and it seems there are other non-
SNI enabled bindings listening to the same endpoint, which means we cannot updat
e it without potentially causing problems. Instead, a new binding will be create
d. You may manually update the bindings if you want IIS to be configured in a di
fferent way.
[WARN] Prevent adding duplicate binding for *:443:
[INFO] Adding new https binding *:443:autodiscover.antonar.by
[INFO] Committing 2 https binding changes to IIS
[INFO] Installation step 2/2: Script...
[INFO] Script ./Scripts/ImportExchange.ps1 starting with parameters "'857CEDA39
9F68D9FF20E1D7C5CF7CEE8C57589A7' 'IIS,SMTP,IMAP' '1' 'C:\ProgramData\win-acme\ac
me-staging-v02.api.letsencrypt.org\Certificates\y3vsuhNaX0OaEVw5UGLxDw-cache.pfx
' '8oHI9EglPRwOJaF5endcJGcMJndhLkQDDSgeBa9GPGo=' '[Manual] mail.antonar.by 2019.
9.19 8:55:45'"
[DBUG] Process launched: powershell.exe (ID: 26016)
[VERB] Waiting for process to finish...
[VERB] Waiting for process to finish...
[VERB] Waiting for process to finish...
[VERB] Waiting for process to finish...
[VERB] Waiting for process to finish...
[VERB] Waiting for process to finish...
[VERB] Waiting for process to finish...
[VERB] Waiting for process to finish...
[VERB] Waiting for process to finish...
[VERB] Waiting for process to finish...
[VERB] Waiting for process to finish...
[VERB] Waiting for process to finish...

Where can I see what is happening in powershell?

TY for your help

@SirKennyLogins
Copy link

Hi Walkman78, I ran into this same issue. I decided to run the ImportExchange.ps1 interactively by passing it the same strings that pop up in the Info window while initially running manual wacs.exe setup.

I started a new powershell session and changed to the Scripts directory of win-acme and ran
ImportExchange.ps1 and pasted in the real values of the parameters. It immediately prompted me to re-input the Services portion so I thought that is where the issue lay.

I cancelled and ran ImportExchange.ps1 with no parameters. I pasted in the certthumbprint and services manually. Once I hit enter on the services the script continued and the certificate installed successfully.

Long story short, I'm wondering if it's possible for you to run the manual wacs.exe setup, but delete all of the scriptparameters except for the first two and see if it runs successfully for you?

IE --scriptparameters "'{CertThumbprint}' 'IIS,SMTP,IMAP'"

And see if that works?

@KononovichAI
Copy link
Author

KononovichAI commented Sep 20, 2019

Hi NibblesJabroni, The script does not work through wacs even with minimal parameters. Forced work over a powershell works well.
Maybe there is an opportunity to transfer parameters to a file? Then based on this, I would make a certificate registration file in powershell. I need thumbprint.

@WouterTinus
Copy link
Member

WouterTinus commented Sep 20, 2019

I had a user with a similar problem that got solved by installing the latest version of Powershell (they were on 2.0) but I'm stumped to see it happen on 5.1 without any output from the process.

The output is supposed to show in VERB messages and it should appear in the Windows Event Viewer as well.

Would you mind trying to run a very simple .ps1 that only prints Hello World and see if that works? I'm curious if this is something fundamental to Powershell like before, or something specific to this script.

@KononovichAI
Copy link
Author

I run wacs.exe --test --verbose --target manual --host mail.antonar.by,autodiscover.antonar.by --installation script --script "./Scripts/test.ps1"

here is a part of the log

[INFO] Installing with Script...
[INFO] Script ./Scripts/test.ps1 starting with parameters
[DBUG] Process launched: powershell.exe (ID: 24528)
[VERB] Hello, World!
[VERB] Process output without data received
[INFO] Script finished
[VERB] Process error without data received
[VERB] Waiting for process to finish...

@KononovichAI
Copy link
Author

I think they use powershell.exe -nologo -noninteractive -windowStyle hidden
what is wrong. Admin must see everything

@SirKennyLogins
Copy link

My server is running Powershell 3.0.
I believe the issue is how wacs.exe passes the parameters to the powershell script. I re-ran the manual job from commandline but with transcripts enabled on the system and I received this in the transcript log:

**********************
Windows PowerShell transcript start
Start time: 20190920090659
Username  : DOMAIN\administrator 
Machine	  : CONTOSO-EX1 (Microsoft Windows NT 6.1.7601 Service Pack 1) 
**********************

cmdlet ImportExchange.ps1 at command pipeline position 1
Supply values for the following parameters:
ExchangeServices: 

The timestamp coincides with the console repeating

[VERB] Waiting for process to finish...

Until the 5 minute timeout is reached.

I believe the issue is that the wacs.exe is not passing multiple parameters to the powershell script, it is passing all of the generated parameters as a single string to ImportExchange.ps1, which the script is interpreting as the FIRST positional parameter only. It is then stuck waiting for you to type in the rest of the required parameters.

I have tried to get around this by removing the double-quotes on the parameters after --scriptparameters but that causes wacs.exe to lock up even earlier in the process.

Maybe someone can shed some light on how we can better pass the script parameters from wacs.exe to the powershell script?

@WouterTinus
Copy link
Member

WouterTinus commented Sep 20, 2019 via email

@SirKennyLogins
Copy link

That did it! Escaping the double-quotes with \ allows it to run correctly.

So @Walkman78, change your command to:

... --scriptparameters \"'{CertThumbprint}' 'IIS,SMTP,IMAP' 1 '{CacheFile}' '{CachePassword}' '{CertFriendlyName}'\"

@KononovichAI
Copy link
Author

KononovichAI commented Sep 23, 2019

hmm ... I try this week.

@WouterTinus WouterTinus added this to the 2.1.0 milestone Sep 26, 2019
@WouterTinus WouterTinus changed the title Exchange 2013 Script parameters from command line not parsed properly Sep 26, 2019
@WouterTinus
Copy link
Member

Fixed in beta3

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants