{"id":353767,"date":"2024-08-30T12:02:50","date_gmt":"2024-08-30T12:02:50","guid":{"rendered":"https:\/\/www.ninjaone.com\/script-hub\/gestionar-certificados\/"},"modified":"2024-10-13T19:07:30","modified_gmt":"2024-10-13T19:07:30","slug":"gestionar-certificados","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/es\/script-hub\/gestionar-certificados\/","title":{"rendered":"C\u00f3mo encontrar, eliminar y gestionar certificados por huella dactilar de forma eficaz mediante PowerShell"},"content":{"rendered":"

La gesti\u00f3n de certificados de sistemas es una tarea cr\u00edtica para los profesionales de TI y los proveedores de servicios gestionados (MSP)<\/a>. Los certificados son la columna vertebral de la comunicaci\u00f3n segura, y garantizar su correcta gesti\u00f3n es esencial para mantener la integridad y seguridad de los sistemas inform\u00e1ticos. Este completo script de PowerShell est\u00e1 dise\u00f1ado para agilizar el proceso de b\u00fasqueda y eliminaci\u00f3n de certificados de sistema por huella digital<\/strong>, respondiendo as\u00ed a una necesidad com\u00fan en el mundo de TI.<\/p>\n

Background<\/h2>\n

Los certificados autentican y cifran los datos para garantizar una comunicaci\u00f3n segura a trav\u00e9s de las redes. Con el tiempo, los certificados pueden perder su validez, caducar o verse comprometidos, lo que obliga a eliminarlos. Los profesionales de TI y los MSP suelen necesitar un m\u00e9todo fiable para localizar y gestionar certificados de forma eficaz. Este script de PowerShell proporciona una soluci\u00f3n s\u00f3lida para buscar y gestionar certificados por huella digital, garantizando que los sistemas permanezcan seguros y cumplan las normativas.<\/p>\n

El script para gestionar certificados del sistema<\/h2>\n
#Requires -Version 5.1\r\n\r\n<#\r\n.SYNOPSIS\r\n    Returns a list of system certificates that have the specified thumbprints or Removes the certificates with matching thumbprints.\r\n.DESCRIPTION\r\n    Returns a list of system certificates that have the specified thumbprints or Removes the certificates with matching thumbprints.\r\n\r\n.EXAMPLE\r\n    (No Parameters)\r\n    ## EXAMPLE OUTPUT WITHOUT PARAMS ##\r\n    Does nothing.\r\n\r\n.EXAMPLE\r\nPARAMETER: -Thumbprint \"AE68D0ADAD2345B48E507320B695D386080E5B25\", \"BE68D0ADAA2145B48E507320B695D386080E5B25\"\r\n    Returns the found thumbprints matching the input.\r\n    ## EXAMPLE OUTPUT WITH Thumbprint ##\r\n    [Alert] Found certificates:\r\n    AE68D0ADAD2345B48E507320B695D386080E5B25\r\n    BE68D0ADAA2145B48E507320B695D386080E5B25\r\n    [Alert] Certificates found\r\n\r\n.EXAMPLE\r\nPARAMETER: -Thumbprint \"BE68D0ADAA2145B48E507320B695D386080E5B25\" -RemoveMatchingCertificates\r\n    Returns the found thumbprints matching the input and Removes the certificates.\r\n    ## EXAMPLE OUTPUT WITH RemoveMatchingCertificates ##\r\n    [Alert] Found certificates:\r\n    BE68D0ADAA2145B48E507320B695D386080E5B25\r\n    [Info] Removing certificates\r\n    [Info] Removing certificate with thumbprint: BE68D0ADAA2145B48E507320B695D386080E5B25\r\n    [Info] Removed certificate with thumbprint: BE68D0ADAA2145B48E507320B695D386080E5B25\r\n    [Alert] Certificates found\r\n.EXAMPLE\r\nPARAMETER: -Thumbprint \"BE68D0ADAA2145B48E507320B695D386080E5B25\" -CustomField \"Thumbprints\"\r\n    Returns the found thumbprints matching the input and Removes the certificates.\r\n    ## EXAMPLE OUTPUT WITH RemoveMatchingCertificates ##\r\n    [Alert] Found certificates:\r\n    BE68D0ADAA2145B48E507320B695D386080E5B25\r\n    [Info] Saving thumbprints to custom field: Thumbprints\r\n    [Alert] Certificates found\r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    Minimum OS Architecture Supported: Windows 10, Windows Server 2016\r\n    Release Notes: Initial Release\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n.COMPONENT\r\n    Generic-Security\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    [string[]]$Thumbprint,\r\n    [switch]$RemoveMatchingCertificates,\r\n    [string]$CertRevokeList,\r\n    [string]$GetCrlFromCustomField,\r\n    [string]$CustomField\r\n)\r\n\r\nbegin {\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n    }\r\n    function Set-NinjaProperty {\r\n        [CmdletBinding()]\r\n        Param(\r\n            [Parameter(Mandatory = $True)]\r\n            [String]$Name,\r\n            [Parameter()]\r\n            [String]$Type,\r\n            [Parameter(Mandatory = $True, ValueFromPipeline = $True)]\r\n            $Value,\r\n            [Parameter()]\r\n            [String]$DocumentName\r\n        )\r\n\r\n        # If we're requested to set the field value for a Ninja document we'll specify it here.\r\n        $DocumentationParams = @{}\r\n        if ($DocumentName) { $DocumentationParams[\"DocumentName\"] = $DocumentName }\r\n\r\n        # This is a list of valid fields we can set. If no type is given we'll assume the input doesn't have to be changed in any way.\r\n        $ValidFields = \"Attachment\", \"Checkbox\", \"Date\", \"Date or Date Time\", \"Decimal\", \"Dropdown\", \"Email\", \"Integer\", \"IP Address\", \"MultiLine\", \"MultiSelect\", \"Phone\", \"Secure\", \"Text\", \"Time\", \"URL\"\r\n        if ($Type -and $ValidFields -notcontains $Type) { Write-Warning \"$Type is an invalid type! Please check here for valid types. https:\/\/ninjarmm.zendesk.com\/hc\/en-us\/articles\/16973443979789-Command-Line-Interface-CLI-Supported-Fields-and-Functionality\" }\r\n\r\n        # The below field requires additional information in order to set\r\n        $NeedsOptions = \"Dropdown\"\r\n        if ($DocumentName) {\r\n            if ($NeedsOptions -contains $Type) {\r\n                # We'll redirect the error output to the success stream to make it easier to error out if nothing was found or something else went wrong.\r\n                $NinjaPropertyOptions = Ninja-Property-Docs-Options -AttributeName $Name @DocumentationParams 2>&1\r\n            }\r\n        }\r\n        else {\r\n            if ($NeedsOptions -contains $Type) {\r\n                $NinjaPropertyOptions = Ninja-Property-Options -Name $Name 2>&1\r\n            }\r\n        }\r\n\r\n        # If we received some sort of error it should have an exception property and we'll exit the function with that error information.\r\n        if ($NinjaPropertyOptions.Exception) { throw $NinjaPropertyOptions }\r\n\r\n        # The below type's require values not typically given in order to be set. The below code will convert whatever we're given into a format ninjarmm-cli supports.\r\n        switch ($Type) {\r\n            \"Checkbox\" {\r\n                # While it's highly likely we were given a value like \"True\" or a boolean datatype it's better to be safe than sorry.\r\n                $NinjaValue = [System.Convert]::ToBoolean($Value)\r\n            }\r\n            \"Date or Date Time\" {\r\n                # Ninjarmm-cli is expecting the time to be representing as a Unix Epoch string. So we'll convert what we were given into that format.\r\n                $Date = (Get-Date $Value).ToUniversalTime()\r\n                $TimeSpan = New-TimeSpan (Get-Date \"1970-01-01 00:00:00\") $Date\r\n                $NinjaValue = $TimeSpan.TotalSeconds\r\n            }\r\n            \"Dropdown\" {\r\n                # Ninjarmm-cli is expecting the guid of the option we're trying to select. So we'll match up the value we were given with a guid.\r\n                $Options = $NinjaPropertyOptions -replace '=', ',' | ConvertFrom-Csv -Header \"GUID\", \"Name\"\r\n                $Selection = $Options | Where-Object { $_.Name -eq $Value } | Select-Object -ExpandProperty GUID\r\n\r\n                if (-not $Selection) {\r\n                    throw \"Value is not present in dropdown\"\r\n                }\r\n\r\n                $NinjaValue = $Selection\r\n            }\r\n            default {\r\n                # All the other types shouldn't require additional work on the input.\r\n                $NinjaValue = $Value\r\n            }\r\n        }\r\n\r\n        # We'll need to set the field differently depending on if its a field in a Ninja Document or not.\r\n        if ($DocumentName) {\r\n            $CustomField = Ninja-Property-Docs-Set -AttributeName $Name -AttributeValue $NinjaValue @DocumentationParams 2>&1\r\n        }\r\n        else {\r\n            $CustomField = Ninja-Property-Set -Name $Name -Value $NinjaValue 2>&1\r\n        }\r\n\r\n        if ($CustomField.Exception) {\r\n            throw $CustomField\r\n        }\r\n    }\r\n    # This function is to make it easier to parse Ninja Custom Fields.\r\n    function Get-NinjaProperty {\r\n        [CmdletBinding()]\r\n        Param(\r\n            [Parameter(Mandatory = $True, ValueFromPipeline = $True)]\r\n            [String]$Name,\r\n            [Parameter()]\r\n            [String]$Type,\r\n            [Parameter()]\r\n            [String]$DocumentName\r\n        )\r\n    \r\n        if ($PSVersionTable.PSVersion.Major -lt 3) {\r\n            throw \"PowerShell 3.0 or higher is required to retrieve data from custom fields. https:\/\/ninjarmm.zendesk.com\/hc\/en-us\/articles\/4405408656013\"\r\n        }\r\n    \r\n        # If we're requested to get the field value from a Ninja document we'll specify it here.\r\n        $DocumentationParams = @{}\r\n        if ($DocumentName) { $DocumentationParams[\"DocumentName\"] = $DocumentName }\r\n    \r\n        # These two types require more information to parse.\r\n        $NeedsOptions = \"DropDown\", \"MultiSelect\"\r\n    \r\n        # Grabbing document values requires a slightly different command.\r\n        if ($DocumentName) {\r\n            # Secure fields are only readable when they're a device custom field\r\n            if ($Type -Like \"Secure\") { throw \"$Type is an invalid type! Please check here for valid types. https:\/\/ninjarmm.zendesk.com\/hc\/en-us\/articles\/16973443979789-Command-Line-Interface-CLI-Supported-Fields-and-Functionality\" }\r\n    \r\n            # We'll redirect the error output to the success stream to make it easier to error out if nothing was found or something else went wrong.\r\n            Write-Host \"Retrieving value from Ninja Document...\"\r\n            $NinjaPropertyValue = Ninja-Property-Docs-Get -AttributeName $Name @DocumentationParams 2>&1\r\n    \r\n            # Certain fields require more information to parse.\r\n            if ($NeedsOptions -contains $Type) {\r\n                $NinjaPropertyOptions = Ninja-Property-Docs-Options -AttributeName $Name @DocumentationParams 2>&1\r\n            }\r\n        }\r\n        else {\r\n            # We'll redirect error output to the success stream to make it easier to error out if nothing was found or something else went wrong.\r\n            $NinjaPropertyValue = Ninja-Property-Get -Name $Name 2>&1\r\n    \r\n            # Certain fields require more information to parse.\r\n            if ($NeedsOptions -contains $Type) {\r\n                $NinjaPropertyOptions = Ninja-Property-Options -Name $Name 2>&1\r\n            }\r\n        }\r\n    \r\n        # If we received some sort of error it should have an exception property and we'll exit the function with that error information.\r\n        if ($NinjaPropertyValue.Exception) { throw $NinjaPropertyValue }\r\n        if ($NinjaPropertyOptions.Exception) { throw $NinjaPropertyOptions }\r\n    \r\n        # This switch will compare the type given with the quoted string. If it matches, it'll parse it further; otherwise, the default option will be selected.\r\n        switch ($Type) {\r\n            \"Attachment\" {\r\n                # Attachments come in a JSON format this will convert it into a PowerShell Object.\r\n                $NinjaPropertyValue | ConvertFrom-Json\r\n            }\r\n            \"Checkbox\" {\r\n                # Checkbox's come in as a string representing an integer. We'll need to cast that string into an integer and then convert it to a more traditional boolean.\r\n                [System.Convert]::ToBoolean([int]$NinjaPropertyValue)\r\n            }\r\n            \"Date or Date Time\" {\r\n                # In Ninja Date and Date\/Time fields are in Unix Epoch time in the UTC timezone the below should convert it into local time as a datetime object.\r\n                $UnixTimeStamp = $NinjaPropertyValue\r\n                $UTC = (Get-Date \"1970-01-01 00:00:00\").AddSeconds($UnixTimeStamp)\r\n                $TimeZone = [TimeZoneInfo]::Local\r\n                [TimeZoneInfo]::ConvertTimeFromUtc($UTC, $TimeZone)\r\n            }\r\n            \"Decimal\" {\r\n                # In ninja decimals are strings that represent a decimal this will cast it into a double data type.\r\n                [double]$NinjaPropertyValue\r\n            }\r\n            \"Device Dropdown\" {\r\n                # Device Drop-Downs Fields come in a JSON format this will convert it into a PowerShell Object.\r\n                $NinjaPropertyValue | ConvertFrom-Json\r\n            }\r\n            \"Device MultiSelect\" {\r\n                # Device Multi-Select Fields come in a JSON format this will convert it into a PowerShell Object.\r\n                $NinjaPropertyValue | ConvertFrom-Json\r\n            }\r\n            \"Dropdown\" {\r\n                # Drop-Down custom fields come in as a comma-separated list of GUIDs; we'll compare these with all the options and return just the option values selected instead of a GUID.\r\n                $Options = $NinjaPropertyOptions -replace '=', ',' | ConvertFrom-Csv -Header \"GUID\", \"Name\"\r\n                $Options | Where-Object { $_.GUID -eq $NinjaPropertyValue } | Select-Object -ExpandProperty Name\r\n            }\r\n            \"Integer\" {\r\n                # Cast's the Ninja provided string into an integer.\r\n                [int]$NinjaPropertyValue\r\n            }\r\n            \"MultiSelect\" {\r\n                # Multi-Select custom fields come in as a comma-separated list of GUID's we'll compare these with all the options and return just the option values selected instead of a guid.\r\n                $Options = $NinjaPropertyOptions -replace '=', ',' | ConvertFrom-Csv -Header \"GUID\", \"Name\"\r\n                $Selection = ($NinjaPropertyValue -split ',').trim()\r\n    \r\n                foreach ($Item in $Selection) {\r\n                    $Options | Where-Object { $_.GUID -eq $Item } | Select-Object -ExpandProperty Name\r\n                }\r\n            }\r\n            \"Organization Dropdown\" {\r\n                # Turns the Ninja provided JSON into a PowerShell Object.\r\n                $NinjaPropertyValue | ConvertFrom-Json\r\n            }\r\n            \"Organization Location Dropdown\" {\r\n                # Turns the Ninja provided JSON into a PowerShell Object.\r\n                $NinjaPropertyValue | ConvertFrom-Json\r\n            }\r\n            \"Organization Location MultiSelect\" {\r\n                # Turns the Ninja provided JSON into a PowerShell Object.\r\n                $NinjaPropertyValue | ConvertFrom-Json\r\n            }\r\n            \"Organization MultiSelect\" {\r\n                # Turns the Ninja provided JSON into a PowerShell Object.\r\n                $NinjaPropertyValue | ConvertFrom-Json\r\n            }\r\n            \"Time\" {\r\n                # Time fields are given as a number of seconds starting from midnight. This will convert it into a datetime object.\r\n                $Seconds = $NinjaPropertyValue\r\n                $UTC = ([timespan]::fromseconds($Seconds)).ToString(\"hh\\:mm\\:ss\")\r\n                $TimeZone = [TimeZoneInfo]::Local\r\n                $ConvertedTime = [TimeZoneInfo]::ConvertTimeFromUtc($UTC, $TimeZone)\r\n    \r\n                Get-Date $ConvertedTime -DisplayHint Time\r\n            }\r\n            default {\r\n                # If no type was given or not one that matches the above types just output what we retrieved.\r\n                $NinjaPropertyValue\r\n            }\r\n        }\r\n    }\r\n    # Utility function for downloading files.\r\n    function Invoke-Download {\r\n        param(\r\n            [Parameter()]\r\n            [String]$URL,\r\n            [Parameter()]\r\n            [String]$Path,\r\n            [Parameter()]\r\n            [int]$Attempts = 3,\r\n            [Parameter()]\r\n            [Switch]$SkipSleep\r\n        )\r\n        Write-Host \"URL given, Downloading the file...\"\r\n\r\n        $SupportedTLSversions = [enum]::GetValues('Net.SecurityProtocolType')\r\n        if ( ($SupportedTLSversions -contains 'Tls13') -and ($SupportedTLSversions -contains 'Tls12') ) {\r\n            [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol::Tls13 -bor [System.Net.SecurityProtocolType]::Tls12\r\n        }\r\n        elseif ( $SupportedTLSversions -contains 'Tls12' ) {\r\n            [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12\r\n        }\r\n        else {\r\n            # Not everything requires TLS 1.2, but we'll try anyway.\r\n            Write-Warning \"TLS 1.2 and or TLS 1.3 are not supported on this system. This download may fail!\"\r\n            if ($PSVersionTable.PSVersion.Major -lt 3) {\r\n                Write-Warning \"PowerShell 2 \/ .NET 2.0 doesn't support TLS 1.2.\"\r\n            }\r\n        }\r\n\r\n        $i = 1\r\n        While ($i -le $Attempts) {\r\n            # Some cloud services have rate-limiting\r\n            if (-not ($SkipSleep)) {\r\n                $SleepTime = Get-Random -Minimum 3 -Maximum 15\r\n                Write-Host \"Waiting for $SleepTime seconds.\"\r\n                Start-Sleep -Seconds $SleepTime\r\n            }\r\n        \r\n            if ($i -ne 1) { Write-Host \"\" }\r\n            Write-Host \"Download Attempt $i\"\r\n\r\n            try {\r\n                # Invoke-WebRequest is preferred because it supports links that redirect, e.g., https:\/\/t.ly\r\n                if ($PSVersionTable.PSVersion.Major -lt 4) {\r\n                    # Downloads the file\r\n                    $WebClient = New-Object System.Net.WebClient\r\n                    $WebClient.DownloadFile($URL, $Path)\r\n                }\r\n                else {\r\n                    # Standard options\r\n                    $WebRequestArgs = @{\r\n                        Uri                = $URL\r\n                        OutFile            = $Path\r\n                        MaximumRedirection = 10\r\n                        UseBasicParsing    = $true\r\n                    }\r\n\r\n                    # Downloads the file\r\n                    Invoke-WebRequest @WebRequestArgs\r\n                }\r\n\r\n                $File = Test-Path -Path $Path -ErrorAction SilentlyContinue\r\n            }\r\n            catch {\r\n                Write-Warning \"An error has occurred while downloading!\"\r\n                Write-Warning $_.Exception.Message\r\n\r\n                if (Test-Path -Path $Path -ErrorAction SilentlyContinue) {\r\n                    Remove-Item $Path -Force -Confirm:$false -ErrorAction SilentlyContinue\r\n                }\r\n\r\n                $File = $False\r\n            }\r\n\r\n            if ($File) {\r\n                $i = $Attempts\r\n            }\r\n            else {\r\n                Write-Warning \"File failed to download.\"\r\n                Write-Host \"\"\r\n            }\r\n\r\n            $i++\r\n        }\r\n\r\n        if (-not (Test-Path $Path)) {\r\n            Write-Warning \"Failed to download file!\"\r\n        }\r\n        else {\r\n            return $Path\r\n        }\r\n    }\r\n\r\n    function Revoke-Certificate {\r\n        param (\r\n            $Object,\r\n            $Loop = 0\r\n        )\r\n        $CrlPath = \"$TEMP\\CertRevokeListScript-$(Get-Date -Format FileDate).crl\"\r\n        Write-Host \"[Info] Revoking certificates with CRL file from Path, URL, or custom field: $Object\"\r\n        if ($Object -like \"http*\") {\r\n            Write-Host \"[Info] Downloading CRL file\"\r\n            try {\r\n                # Download the CRL file\r\n                Invoke-Download -URL $Object -Path $CrlPath -SkipSleep -ErrorAction Stop\r\n                Write-Host \"[Info] Downloaded CRL file to $CrlPath\"\r\n                # Revoke the certificates\r\n                certutil.exe -addstore CA $CrlPath\r\n                Write-Host \"[Info] Added CRL to the list of revoked certificates\"\r\n            }\r\n            catch {\r\n                Write-Host \"[Error] Failed to download CRL file\"\r\n                exit 1\r\n            }\r\n            # Remove the temporary CRL file\r\n            try {\r\n                Remove-Item -Path $CrlPath -Force -Confirm:$false -ErrorAction Stop\r\n            }\r\n            catch {\r\n                Write-Host \"[Error] Failed to remove temporary CRL file\"\r\n                exit 1\r\n            }\r\n        }\r\n        elseif ($(Test-Path -Path $Object -ErrorAction SilentlyContinue)) {\r\n            # Revoke the certificates\r\n            Write-Host \"[Info] Adding CRL to the list of revoked certificates\"\r\n            try {\r\n                $Object | Set-Content -Path $CrlPath -Force -ErrorAction Stop\r\n                # Revoke the certificates\r\n                certutil.exe -addstore CA $CrlPath\r\n                Write-Host \"[Info] Added CRL to the list of revoked certificates\"\r\n            }\r\n            catch {\r\n                Write-Host \"[Error] Failed to revoke certificates with CRL file\"\r\n                exit 1\r\n            }\r\n            # Remove the temporary CRL file\r\n            try {\r\n                Remove-Item -Path $CrlPath -Force -Confirm:$false -ErrorAction Stop\r\n            }\r\n            catch {\r\n                Write-Host \"[Error] Failed to remove temporary CRL file\"\r\n                exit 1\r\n            }\r\n        }\r\n        else {\r\n            $ValueFromCf = Get-NinjaProperty -Name $Object\r\n            if (\r\n                # Check if Loop is 0 and the value from the custom field is a path or URL\r\n                $Loop -eq 0 -and (\r\n                    $(Test-Path -Path $ValueFromCf -ErrorAction SilentlyContinue) -or\r\n                    $ValueFromCf -like \"http*\"\r\n                )\r\n            ) {\r\n                # Call Revoke-Certificate if the Custom Field value is a path or URL\r\n                # We'll only call Revoke-Certificate once to prevent an infinite loop via $Loop variable\r\n                Revoke-Certificate -Object $ValueFromCf -Loop $($Loop + 1)\r\n                return\r\n            }\r\n            $ValueFromCf | Set-Content -Path $CrlPath -Force -ErrorAction Stop\r\n            \r\n            # Revoke the certificates\r\n            certutil.exe -addstore CA $CrlPath\r\n            if ($LASTEXITCODE -ne 0) {\r\n                Write-Host \"[Error] Failed to revoke certificates with CRL file\"\r\n                exit 1\r\n            }\r\n            Write-Host \"[Info] Added CRL to the list of revoked certificates\"\r\n            # Remove the temporary CRL file\r\n            try {\r\n                Remove-Item -Path $CrlPath -Force -Confirm:$false -ErrorAction Stop\r\n            }\r\n            catch {\r\n                Write-Host \"[Error] Failed to remove temporary CRL file\"\r\n                exit 1\r\n            }\r\n        }\r\n        \r\n    }\r\n}\r\nprocess {\r\n    if (-not (Test-IsElevated)) {\r\n        Write-Error -Message \"Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n    if ($PSSenderInfo) {\r\n        Write-Host \"[Error] This script cannot be run in a PSSession. Please run it locally or via Ninja RMM.\"\r\n        exit 1\r\n    }\r\n\r\n    $CertificatesFound = $false\r\n    $RemoveError = $false\r\n\r\n    # Get a list of thumbprints from the environment variable\r\n    if ($env:Thumbprints -and $env:Thumbprints -ne \"null\") {\r\n        $Thumbprint = $env:Thumbprints -split ',' | ForEach-Object { \"$_\".Trim() }\r\n    }\r\n    elseif ($Thumbprint) {\r\n        # Remove any commas from the thumbprint and trim any whitespace\r\n        $Thumbprint = $Thumbprint | ForEach-Object { \"$($_ -split ',')\".Trim() }\r\n    }\r\n    if ($env:getCrlFromCustomField -and $env:getCrlFromCustomField -ne \"null\") {\r\n        $GetCrlFromCustomField = $env:getCrlFromCustomField\r\n    }\r\n\r\n    # Get crl file path from the environment variable\r\n    if ($env:certificateRevokeListPath -and $env:certificateRevokeListPath -ne \"null\") {\r\n        $CertRevokeList = $env:certificateRevokeListPath\r\n    }\r\n\r\n    # Check that Thumbprint or CertRevokeList where specified\r\n    if ($Thumbprint) {}\r\n    elseif ($CertRevokeList) {}\r\n    elseif ($GetCrlFromCustomField) {}\r\n    else {\r\n        Write-Host \"[Error] Thumbprint or CertRevokeList or GetCrlFromCustomField where not specified. Please specify at least one of them.\"\r\n        exit 2\r\n    }\r\n\r\n    # Check if the RemoveMatchingCertificates switch\/checkbox was selected\r\n    if ($env:removeMatchingCertificates -eq \"true\") {\r\n        $RemoveMatchingCertificates = $true\r\n    }\r\n\r\n    # Get the custom field name from the Script Variable\r\n    if ($env:customField) {\r\n        $CustomField = $env:customField\r\n    }\r\n\r\n    if ($Thumbprint) {\r\n        $Thumbprint = $Thumbprint | ForEach-Object {\r\n            if ($_.Length -eq 40 -and $_ -match \"^[0-9a-fA-F]{40}$\") {\r\n                Write-Host \"[Info] Thumbprint($_) is valid and will be processed.\"\r\n                $_\r\n            }\r\n            else {\r\n                Write-Host \"[Warn] Thumbprint($_) is not valid and will be skipped.\"\r\n            }\r\n        }\r\n    \r\n        # Loop through all certificates installed on the system\r\n        $FoundCertificates = Get-ChildItem -Path Cert:\\LocalMachine\\ -Recurse | Where-Object { $_.Thumbprint -and $_.Thumbprint -in $Thumbprint }\r\n    \r\n        # Output the found certificates\r\n        $OutputThumbprints = if ($FoundCertificates) {\r\n            $CertificatesFound = $true\r\n            Write-Host \"[Alert] Found certificates:\"\r\n            $FoundCertificates = $FoundCertificates | ForEach-Object {\r\n                [PSCustomObject]@{\r\n                    Thumbprint = $_.Thumbprint\r\n                    PSPath     = $_.PSPath\r\n                    ExpiryDate = if ($_.NotAfter) { $_.NotAfter.ToShortDateString() }else { \"No Expiry Date\" }\r\n                }\r\n            }\r\n            if ($FoundCertificates) {\r\n                $thumbprint = \"Thumbprint\"\r\n                $path = \"Path\"\r\n                $padding = 40\r\n\r\n                $centeredThumbprint = $thumbprint.PadLeft(($thumbprint.Length + $padding) \/ 2).PadRight($padding)\r\n                $centeredPath = $path\r\n\r\n                Write-Host \"$centeredThumbprint - $centeredPath - Expires\"\r\n            }\r\n            $FoundCertificates | ForEach-Object {\r\n                $CertPath = $_\r\n                $CertificatePath = $CertPath.PSPath\r\n                # Convert PSPath to how certmgr.mmc formats the path\r\n                $CertificatePath = $CertificatePath -replace 'LocalMachine\\\\', 'Local Computer\\'\r\n                $CertificatePath = $CertificatePath -replace '\\\\My\\\\', '\\Personal\\'\r\n                $CertificatePath = $CertificatePath -replace '\\\\CA\\\\', '\\Intermediate Certification Authorities\\'\r\n                $CertificatePath = $CertificatePath -replace '\\\\Root\\\\', '\\Trusted Root Certification Authorities\\'\r\n                $CertificatePath = $CertificatePath -replace '\\\\Disallowed\\\\', '\\Untrusted Certificates\\'\r\n                $CertificatePath = $CertificatePath -replace '\\\\AuthRoot\\\\', '\\Third-Party Root Certification Authorities\\'\r\n                $CertificatePath = $CertificatePath -replace '\\\\TrustedPublisher\\\\', '\\Trusted Publishers\\'\r\n                $CertificatePath = $CertificatePath -replace '\\\\ClientAuthIssuer\\\\', '\\Client Authentication Issuers\\'\r\n                $CertificatePath = $CertificatePath -replace '\\\\Remote Desktop\\\\', '\\Remote Desktop\\'\r\n                $CertificatePath = $CertificatePath -replace '\\\\SmartCardRoot\\\\', '\\Smart Card Trusted Roots\\'\r\n                $CertificatePath = $CertificatePath -replace '\\\\TrustedPeople\\\\', '\\Trusted People\\'\r\n                $CertificatePath = $CertificatePath -replace '\\\\Trust\\\\', '\\Enterprise Trust\\'\r\n                $CertificatePath = $CertificatePath -replace '\\\\REQUEST\\\\', '\\Certificate Enrollment Requests\\'\r\n                $CertificatePath = $CertificatePath -replace '\\\\AddressBook\\\\', '\\Other People\\'\r\n                $CertificatePath = $CertificatePath -replace '\\\\UserdDS\\\\', '\\Active Directory User Object\\'\r\n                # Output with the formatted path\r\n                \"$($CertPath.Thumbprint) - $($CertificatePath -replace 'Microsoft.PowerShell.Security\\\\Certificate::') - $($CertPath.ExpiryDate)\"\r\n            }\r\n        }\r\n        else {\r\n            Write-Host \"[Info] No certificates found\"\r\n        }\r\n        if ($OutputThumbprints) {\r\n            $OutputThumbprints | Out-String | Write-Host\r\n        }\r\n    \r\n        # Remove the certificates if we should\r\n        if ($RemoveMatchingCertificates) {\r\n            Write-Host \"[Info] Removing certificates\"\r\n            # Loop through all the found certificates\r\n            $FoundCertificates | ForEach-Object {\r\n                $Certificate = $_\r\n                # Remove the certificate\r\n                Write-Host \"[Info] Removing certificate with path: $($Certificate.PSPath -replace 'Microsoft.PowerShell.Security\\\\Certificate::')\"\r\n                try {\r\n                    # Remove the certificate and its private key\r\n                    # More Info: https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/microsoft.powershell.security\/about\/about_certificate_provider?view=powershell-5.1#deleting-certificates-and-private-keys\r\n                    if ($IsLinux) {\r\n                        # Only used for testing purposes\r\n                        Remove-Item -Path $Certificate.PSPath -Force -Confirm:$false -ErrorAction Stop\r\n                    }\r\n                    else {\r\n                        Remove-Item -Path $Certificate.PSPath -DeleteKey -Force -Confirm:$false -ErrorAction Stop\r\n                    }\r\n                    Write-Host \"[Info] Removed certificate with path: $($Certificate.PSPath -replace 'Microsoft.PowerShell.Security\\\\Certificate::')\"\r\n                }\r\n                catch {\r\n                    # Only error if there is only one certificate\r\n                    # More than one certificate with the same thumbprint is likely already removed\r\n                    if ($($FoundCertificates | Where-Object { $_ -like $Certificate.Thumbprint }).Count -eq 1) {\r\n                        Write-Host \"[Error] Failed to Remove certificate with thumbprint: $($Certificate.Thumbprint)\"\r\n                        $RemoveError = $true\r\n                    }\r\n                    else {\r\n                        Write-Host \"[Info] Removed certificate with path: $($Certificate.PSPath -replace 'Microsoft.PowerShell.Security\\\\Certificate::')\"\r\n                    }\r\n                }\r\n            }\r\n        }\r\n        else {\r\n            Write-Host \"[Info] Removing certificates is not enabled. Doing nothing.\"\r\n        }\r\n        if ($CustomField) {\r\n            # Save the found thumbprints to a NinjaRMM custom field\r\n            Write-Host \"[Info] Saving thumbprints to custom field: $CustomField\"\r\n            try {\r\n                if ($RemoveMatchingCertificates) {\r\n                    Set-NinjaProperty -Name $CustomField -Value $($OutputThumbprints | ForEach-Object {\r\n                            # Output just the path\r\n                            \"$(\"$_\" -split ' - ' | Select-Object -Skip 1 -First 1) - Removed from system\"\r\n                        } | Out-String) -Type \"MultiLine\"\r\n                }\r\n                else {\r\n                    Set-NinjaProperty -Name $CustomField -Value $($OutputThumbprints | ForEach-Object {\r\n                            # Output just the path\r\n                            \"$(\"$_\" -split ' - ' | Select-Object -Skip 1 -First 1)\"\r\n                        } | Out-String) -Type \"MultiLine\"\r\n                }\r\n            }\r\n            catch {\r\n                # If we ran into some sort of error we'll output it here.\r\n                Write-Error -Message $_.ToString() -Category InvalidOperation -Exception (New-Object System.Exception)\r\n                exit 1\r\n            }\r\n        }\r\n    \r\n        # Exit with an error when we failed to remove a certificate\r\n        if ($RemoveError) {\r\n            Write-Host \"[Error] Failed to Remove one or more certificates\"\r\n            exit 1\r\n        }\r\n    \r\n        # Exit with an error when we found certificates and we shouldn't remove them\r\n        if ($CertificatesFound -and -not $RemoveMatchingCertificates) {\r\n            Write-Host \"[Alert] Certificates found\"\r\n            exit 1\r\n        }\r\n    }\r\n\r\n    if ($CertRevokeList) {\r\n        Revoke-Certificate -Object $CertRevokeList\r\n    }\r\n    if ($GetCrlFromCustomField) {\r\n        Revoke-Certificate -Object $GetCrlFromCustomField\r\n    }\r\n\r\n    # Exit with a success when no certificates were found\r\n    exit 0\r\n}\r\nend {\r\n    \r\n    \r\n    \r\n}<\/pre>\n
 <\/p>\n\n
<\/h2>
<\/p><\/div>
<\/a><\/div><\/div>\n
An\u00e1lisis detallado<\/h2>\n
El script para gestionar certificados por huella dactilar de forma eficaz es una potente herramienta que puede encontrar y, opcionalmente, eliminar certificados bas\u00e1ndose en huellas digitales especificadas. Aqu\u00ed tienes una explicaci\u00f3n paso a paso de c\u00f3mo funciona:<\/p>\n
1. Inicializaci\u00f3n y gesti\u00f3n de par\u00e1metros<\/h3>\n