6.3

Enable HTTPS Protocol for
PowerShell Remoting 7
If you plan to use HTTP, you can skip this section. However, it is recommend to implement HTTPS for
encrypting the traffic between the client and remote server.
This chapter includes the following topics:
n
“Acquire SSL Certificate,” on page 33
n
“Create Self-Signed SSL Certificate Using the IIS Manager,” on page 34
n
“Create Self-Signed SSL Certificate Using Makecert.exe,” on page 34
n
“Create Self-Signed SSL Certificate Using OpenSSL,” on page 34
n
“Import SSL Certificate on Remote Machine,” on page 35
n
“Configure Configure WinRM HTTPS Listener,” on page 35
Acquire SSL Certificate
To set up PowerShell remoting to use HTTPS protocol, deploy an SSL certificate to the remote server.
To acquire an SSL certificate, first generate a self-signed certificate. There are two purposes for using SSL
certificates with PowerShell remoting:
n
Encrypting traffic between client and server
n
Verifying server identity (CN check)
The following are the methods to generate a self-signed SSL certificate:
“Create Self-Signed SSL Certificate Using the IIS Manager,” on page 34
“Create Self-Signed SSL Certificate Using Makecert.exe,” on page 34
“Create Self-Signed SSL Certificate Using OpenSSL,” on page 34
In all these methods, replace HOSTNAME with either the remote server host name or the IP address to be
used to connect to that server. For example, srv1.mycompany.com or 32.53.2.87.
Ensure that your setup meets the following requirements when generating SSL certificate to use with
PowerShell remoting:
n
Set the Certificate Enhanced Key Usage (EKU) "Server Authentication" (OID=1.3.6.1.5.5.7.3.1).
n
Set the Certificate Subject to "CN=HOSTNAME".
In all these methods, an SSL certificate in PKCS12 format (PFX file) without a password is generated.
VMware, Inc.
33