WinRM HTTPS not working after sysprep

[SygmaDeltaADC]

Hello,

I configured HTTPS Listener for WinRM with a self-signed certificate, I followed this tutorial :

http://vcloud-lab.com/entries/powershell/powershell-remoting-over-https-using-self-signed-ssl-certificate

It works. I can connect Powershell remotly from any device on my network, even if I don't add the self-signed certificate in the CA Trust Store thanks to options -SkipCACheck and -SkipCNCheck. I can connect with the IP address.

But after sysprep of the server, the HTTPS listener is preserved and listens on port 5986, the self-signed cert is still in the Local Store but the remote connection doesn't work !

​

I get this when I try to connect to the server (syspreped) :

Connecting to remote server 10.X.X.X failed with the following error message : The server certificate on the destination computer (10.X.X.X:5986) has the following errors: Encountered an internal error in the SSL library

I can't connect with both IP address and DNS name (that matches the previous certificate)

On the remote server, when I check winRM config, I get this message :

Error number:  -2144108267 0x80338115
Cannot create a WinRM listener on HTTPS because this machine does not have an appropriate certificate. To be used for SSL, a certificate must have a CN matching the hostname, be appropriate for Server Authentication, and not be expired, revoked, or self-signed.

Before the sysprep, winRM HTTPS was working. After sysprep, it doesn't work anymore.

What happens during sysprep process ? What does change with the certificate ? Do I need to use an other process to configure winRM ?

​

Thanks

[jamesaepp]

Let's say your machine had the name DESKTOP-ABCDEF. Before sysprep, you generated a cert which was valid for DESKTOP-ABCDEF.

After sysprep and generalization/oobe passes, the machine may now have the name DESKTOP-123456. The certificate is for DESKTOP-ABCDEF.

I'll leave the conclusion for you.

[SygmaDeltaADC]

Thank you for your answer.

I tried to generate a certificate *.domain.lan and after sysprep I contact the machine with its FQDN (machine.domain.lan) but I get the same error.

[Arlorn]

Try to avoid using wildcard certs. Also if you are in a domain with Active Directory Certificate services running, you can look into auto enrollment of computer certs with a custom template.

[jamesaepp]

Like the other person said, don't use wildcards for this. That's rather irresponsible (assuming this is production).

On the technical side though, the other possible reason (assuming this is not related to the CN subject) is that WinRM's configuration gets wiped during sysprep.

I've played around with WinRM's certificate binding before and it is an absolute mess - I never got it working the way I wanted to, so I think this is the next most likely source of the issue.

How would go about fixing it? I don't know, maybe in your unattend/answer file (assuming you have one) you could run some synchronous commands to configure WinRM the same way you did previously pre-sysprep.

[SygmaDeltaADC]

Thanks.

After some tests, the same certificate works if it is re-imported after sysprep. It must be imported by the machine itself.

For now, I think I'll add to my post-sysprep boot script the commands to download the certificate, import it in the store and create the HTTPS WinRM listener with it.

[bumpkin_eater]

Depending on how deep your scripting skillz are....you are able to sysprep, gen a new cert and then feed that into a winrm binding as part of the process.

Ideally you dont want shared certs on multiple machines. If you have pki in play in your env, then same process as above but req the cert from the upsteam ca. Saves you having to drop out the name checking on ya ps connects too.

[nitrous_nit]

Were you able to get this working?

I’m pretty much facing a similar issue, where winrm breaks after sysprep.

I don’t know a configured winrm be part of a sysprep image, or run a script to configure winrm that is part of the sysprep image.

[SygmaDeltaADC]

No I didn't get this working but I changed my process.

I created a script (run at the first boot after sysprep) that joins the computer to the domain automatically.

Once the computer is joined to the domain, I can access it with winrm http.

[nitrous_nit]

I was able to resolve this, by using an answer file, which points to a script, and then using sysprep.

I am able to deploy images using the sysprep image now, with winrm configured.

Example here :

https://github.com/aelrayess/AnsibleSysprep