DSC credential certificate with Nano Server

[PlagueHO]

I have been battling this problem as well and thought I'd see if you guys had a solution, but found it was still on your Todo: list (https://github.com/VirtualEngine/Lability/blob/dev/Lib/BootStrap.ps1#L17).

So thought I'd have a crack at the issue in my tools. Thought I'd share the solution I came up with in case it helps.

The solution I found was:

1. create the cert on the Host
2. export it as a PFX
3. inject the PFX to the Nano VM boot VHD
4. import it using the CertOC.exe tool that comes with Nano when OS is first booted (using SetupComplete.cmd)

CertOC.exe is a bit flaky though because the PFX seems to only want to be imported into the Root store (at least for me). Also, the process is a bit insecure as far as processes go (because the PFX and password must be on disk on the VM - at least temporarily).

I got the solution to this from here:
https://technet.microsoft.com/en-us/library/mt627783.aspx

Feel free to close this issue. I would have dropped this through on Gitter but I couldn't find one for this repo.

Hope you don't mind me rummaging around through your code 😄 you guys write really nice stuff!

[iainbrighton]

@PlagueHO Feel free to have a nosey around and use whatever you like!

Yup, Nano is in a state of flux and I've not spent too long on it as who knows what will happen between TP releases. It is on the radar, but I guess I'm really holding out for MS to sort this (they'll have to right?). Have you seen this? https://github.com/fearthecowboy/CertScriptTool/blob/master/README.md.

[PlagueHO]

@iainbrighton : Thanks 😄

I'm hoping they do change this behaviour in future releases of Nano. I'm also hoping Domain Join is also supported without using blobs (it's fairly fiddly to automate the joining of Nano Servers to a lab domain).

I actually tried using another similar script on Nano: https://gallery.technet.microsoft.com/scriptcenter/Self-signed-certificate-5920a7c6

However, it throws some WMI exceptions on Nano and I haven't tried to fix them. I'll give the one you listed a try as I think that generating the cert on the guest is the best way to go in the long run.

Cheers!

I'll close this issue now 😄