$credential = $null
$winrmPort = 5986
$authentication = [System.Management.Automation.Runspaces.AuthenticationMechanism]::Default
$useSsh = $false
$sshUserName = $null

<#
.SYNOPSIS
Initialize remote management settings.

.PARAMETER Credential
Credentials to be used for requests.

.PARAMETER Port
Specify to override default WinRM port.

.PARAMETER Authentication
Specify to override preferred authentication mechanism.
#>
function Initialize-RemoteManagement
{
    [CmdletBinding()]
    param
    (
        [Parameter(Mandatory = $true, ParameterSetName = 'WSMan')]
        [System.Management.Automation.PSCredential]
        [System.Management.Automation.Credential()]
        $Credential,
        [Parameter(Mandatory = $false, ParameterSetName = 'WSMan')]
        [int] $Port,
        [Parameter(Mandatory = $false, ParameterSetName = 'WSMan')]
        [System.Management.Automation.Runspaces.AuthenticationMechanism]
        $Authentication,
        [Parameter(Mandatory = $false, ParameterSetName = 'SSH')]
        [string] $UserName
    )

    Get-CallerPreference -Cmdlet $PSCmdlet -SessionState $ExecutionContext.SessionState

    if ($Credential)
    {
        $script:credential = $Credential
    }

    if ($Port)
    {
        $script:winrmPort = $Port
    }

    if ($Authentication)
    {
        $script:authentication = $Authentication
    }

    if ($UserName)
    {
        $script:useSsh = $true
        $script:sshUserName = $UserName
    }
}

<#
.SYNOPSIS
Start a new PowerShell session.

.DESCRIPTION
Start a new PowerShell session with specified host using configured WinRM options.

.PARAMETER ServerHost
Hostname of the computer.
#>
function Start-RemoteSession
{
    [CmdletBinding()]
    param
    (
        [Parameter(Mandatory = $true)]
        [string] $ServerHost
    )

    Get-CallerPreference -Cmdlet $PSCmdlet -SessionState $ExecutionContext.SessionState

    $hostName = [System.Net.Dns]::GetHostByName($ServerHost).Hostname

    if ($useSsh)
    {
        New-PSSession -HostName $hostName -UserName $sshUserName
    }
    else
    {
        New-PSSession -UseSSL -Credential $credential -ComputerName $hostName `
            -Authentication $authentication -Port $winrmPort
    }
}

<#
.SYNOPSIS
Executes a script on a remote server.

.PARAMETER Path
Path to script to be executed.

.PARAMETER Parameters
Parameters to be passed to specified script.

.PARAMETER ServerHost
Hostname of the machine on which the script should be executed.

.PARAMETER Session
Session against which the script will be executed.

.NOTES
Based on code by mjolinor.
http://stackoverflow.com/a/27799658/991267
#>
function Invoke-RemoteScript
{
    [CmdletBinding(DefaultParameterSetName = 'Server')]
    param
    (
        [Parameter(Mandatory = $true)]
        [string] $Path,
        [hashtable] $Parameters,
        [Parameter(Mandatory = $true, ParameterSetName = 'Server')]
        [string] $ServerHost,
        [Parameter(Mandatory = $true, ParameterSetName = 'Session')]
        [System.Management.Automation.Runspaces.PSSession] $Session
    )

    Get-CallerPreference -Cmdlet $PSCmdlet -SessionState $ExecutionContext.SessionState

    if ($ServerHost)
    {
        $Session = Start-RemoteSession $ServerHost
    }

    $scriptContent = Get-Content $Path -Raw
    $scriptParams = `
        &{
            for ($i = 0; $i -lt $args.Length; $i++)
            {
                if ($i % 2 -eq 0)
                {
                    $args[$i]
                }
                else
                {
                    "`"$($args[$i])`""
                }
            }
        } @Parameters
    $sb = [scriptblock]::create("&{ $scriptContent } $scriptParams")

    Invoke-Command -Session $Session -ScriptBlock $sb

    if ($ServerHost)
    {
        Remove-PSSession $Session
    }
}

<#
.Synopsis
    This cmdlet generates a self-signed certificate.
.Description
    This cmdlet generates a self-signed certificate with the required data.
.Parameter Subject
    Specifies the certificate subject in a X500 distinguished name format.
    Example: CN=Test Cert, OU=Sandbox
.Parameter NotBefore
    Specifies the date and time when the certificate become valid. By default previous day
    date is used.
.Parameter NotAfter
    Specifies the date and time when the certificate expires. By default, the certificate is
    valid for 1 year.
.Parameter SerialNumber
    Specifies the desired serial number in a hex format.
    Example: 01a4ff2
.Parameter ProviderName
    Specifies the Cryptography Service Provider (CSP) name. You can use either legacy CSP
    and Key Storage Providers (KSP). By default "Microsoft Enhanced Cryptographic Provider v1.0"
    CSP is used.
.Parameter AlgorithmName
    Specifies the public key algorithm. By default RSA algorithm is used. RSA is the only
    algorithm supported by legacy CSPs. With key storage providers (KSP) you can use CNG
    algorithms, like ECDH. For CNG algorithms you must use full name:
    ECDH_P256
    ECDH_P384
    ECDH_P521

    In addition, KeyLength parameter must be specified explicitly when non-RSA algorithm is used.
.Parameter KeyLength
    Specifies the key length to generate. By default 2048-bit key is generated.
.Parameter KeySpec
    Specifies the public key operations type. The possible values are: Exchange and Signature.
    Default value is Exchange.
.Parameter EnhancedKeyUsage
    Specifies the intended uses of the public key contained in a certificate. You can
    specify either, EKU friendly name (for example 'Server Authentication') or
    object identifier (OID) value (for example '1.3.6.1.5.5.7.3.1').
.Parameter KeyUsages
    Specifies restrictions on the operations that can be performed by the public key contained in the certificate.
    Possible values (and their respective integer values to make bitwise operations) are:
    EncipherOnly
    CrlSign
    KeyCertSign
    KeyAgreement
    DataEncipherment
    KeyEncipherment
    NonRepudiation
    DigitalSignature
    DecipherOnly

    you can combine key usages values by using bitwise OR operation. when combining multiple
    flags, they must be enclosed in quotes and separated by a comma character. For example,
    to combine KeyEncipherment and DigitalSignature flags you should type:
    "KeyEncipherment, DigitalSignature".

    If the certificate is CA certificate (see IsCA parameter), key usages extension is generated
    automatically with the following key usages: Certificate Signing, Off-line CRL Signing, CRL Signing.
.Parameter SubjectAlternativeName
    Specifies alternative names for the subject. Unlike Subject field, this extension
    allows to specify more than one name. Also, multiple types of alternative names
    are supported. The cmdlet supports the following SAN types:
    RFC822 Name
    IP address (both, IPv4 and IPv6)
    Guid
    Directory name
    DNS name
.Parameter IsCA
    Specifies whether the certificate is CA (IsCA = $true) or end entity (IsCA = $false)
    certificate. If this parameter is set to $false, PathLength parameter is ignored.
    Basic Constraints extension is marked as critical.
.Parameter PathLength
    Specifies the number of additional CA certificates in the chain under this certificate. If
    PathLength parameter is set to zero, then no additional (subordinate) CA certificates are
    permitted under this CA.
.Parameter CustomExtension
    Specifies the custom extension to include to a self-signed certificate. This parameter
    must not be used to specify the extension that is supported via other parameters. In order
    to use this parameter, the extension must be formed in a collection of initialized
    System.Security.Cryptography.X509Certificates.X509Extension objects.
.Parameter SignatureAlgorithm
    Specifies signature algorithm used to sign the certificate. By default 'SHA1'
    algorithm is used.
.Parameter FriendlyName
    Specifies friendly name for the certificate.
.Parameter StoreLocation
    Specifies the store location to store self-signed certificate. Possible values are:
    'CurrentUser' and 'LocalMachine'. 'CurrentUser' store is intended for user certificates
    and computer (as well as CA) certificates must be stored in 'LocalMachine' store.
.Parameter StoreName
    Specifies the container name in the certificate store. Possible container names are:
    AddressBook
    AuthRoot
    CertificateAuthority
    Disallowed
    My
    Root
    TrustedPeople
    TrustedPublisher
.Parameter Path
    Specifies the path to a PFX file to export a self-signed certificate.
.Parameter Password
    Specifies the password for PFX file.
.Parameter AllowSMIME
    Enables Secure/Multipurpose Internet Mail Extensions for the certificate.
.Parameter Exportable
    Marks private key as exportable. Smart card providers usually do not allow
    exportable keys.
.Example
    New-SelfsignedCertificateEx -Subject "CN=Test Code Signing" -EKU "Code Signing" -KeySpec "Signature" -KeyUsage "DigitalSignature" -FriendlyName "Test code signing" -NotAfter [datetime]::now.AddYears(5)

    Creates a self-signed certificate intended for code signing and which is valid for 5 years. Certificate
    is saved in the Personal store of the current user account.
.Example
    New-SelfsignedCertificateEx -Subject "CN=www.domain.com" -EKU "Server Authentication", "Client authentication" -KeyUsage "KeyEcipherment, DigitalSignature" -SAN "sub.domain.com","www.domain.com","192.168.1.1" -AllowSMIME -Path C:\test\ssl.pfx -Password (ConvertTo-SecureString "P@ssw0rd" -AsPlainText -Force) -Exportable -StoreLocation "LocalMachine"

    Creates a self-signed SSL certificate with multiple subject names and saves it to a file. Additionally, the
    certificate is saved in the Personal store of the Local Machine store. Private key is marked as exportable,
    so you can export the certificate with a associated private key to a file at any time. The certificate
    includes SMIME capabilities.
.Example
    New-SelfsignedCertificateEx -Subject "CN=www.domain.com" -EKU "Server Authentication", "Client authentication" -KeyUsage "KeyEcipherment, DigitalSignature" -SAN "sub.domain.com","www.domain.com","192.168.1.1" -StoreLocation "LocalMachine" -ProviderName "Microsoft Software Key Storage Provider" -AlgorithmName ecdh_256 -KeyLength 256 -SignatureAlgorithm sha256

    Creates a self-signed SSL certificate with multiple subject names and saves it to a file. Additionally, the
    certificate is saved in the Personal store of the Local Machine store. Private key is marked as exportable,
    so you can export the certificate with a associated private key to a file at any time. Certificate uses
    Ellyptic Curve Cryptography (ECC) key algorithm ECDH with 256-bit key. The certificate is signed by using
    SHA256 algorithm.
.Example
    New-SelfsignedCertificateEx -Subject "CN=Test Root CA, OU=Sandbox" -IsCA $true -ProviderName "Microsoft Software Key Storage Provider" -Exportable

    Creates self-signed root CA certificate.
.NOTES
    New-SelfSignedCertificateEx.ps1
    Version 1.0

    Creates self-signed certificate. This tool is a base replacement
    for deprecated makecert.exe

    Vadims Podans (c) 2013
    http://en-us.sysadmins.lv/
#>
function New-SelfSignedCertificateEx
{
    [CmdletBinding(DefaultParameterSetName = '__store')]
    param (
        [Parameter(Mandatory = $true, Position = 0)]
        [string]$Subject,
        [Parameter(Position = 1)]
        [datetime]$NotBefore = [DateTime]::Now.AddDays(-1),
        [Parameter(Position = 2)]
        [datetime]$NotAfter = $NotBefore.AddDays(365),
        [string]$SerialNumber,
        [Alias('CSP')]
        [string]$ProviderName = "Microsoft Enhanced Cryptographic Provider v1.0",
        [string]$AlgorithmName = "RSA",
        [int]$KeyLength = 2048,
        [validateSet("Exchange","Signature")]
        [string]$KeySpec = "Exchange",
        [Alias('EKU')]
        [Security.Cryptography.Oid[]]$EnhancedKeyUsage,
        [Alias('KU')]
        [Security.Cryptography.X509Certificates.X509KeyUsageFlags]$KeyUsage,
        [Alias('SAN')]
        [String[]]$SubjectAlternativeName,
        [bool]$IsCA,
        [int]$PathLength = -1,
        [Security.Cryptography.X509Certificates.X509ExtensionCollection]$CustomExtension,
        [ValidateSet('MD5','SHA1','SHA256','SHA384','SHA512')]
        [string]$SignatureAlgorithm = "SHA1",
        [string]$FriendlyName,
        [Parameter(ParameterSetName = '__store')]
        [Security.Cryptography.X509Certificates.StoreLocation]$StoreLocation = "CurrentUser",
        [Parameter(ParameterSetName = '__store')]
        [Security.Cryptography.X509Certificates.StoreName]$StoreName = "My",
        [Parameter(Mandatory = $true, ParameterSetName = '__file')]
        [Alias('OutFile','OutPath','Out')]
        [IO.FileInfo]$Path,
        [Parameter(Mandatory = $true, ParameterSetName = '__file')]
        [Security.SecureString]$Password,
        [switch]$AllowSMIME,
        [switch]$Exportable
    )
    $ErrorActionPreference = "Stop"
    if ([Environment]::OSVersion.Version.Major -lt 6) {
        $NotSupported = New-Object NotSupportedException -ArgumentList "Windows XP and Windows Server 2003 are not supported!"
        throw $NotSupported
    }
    $ExtensionsToAdd = @()

#region constants
    # contexts
    New-Variable -Name UserContext -Value 0x1 -Option Constant
    New-Variable -Name MachineContext -Value 0x2 -Option Constant
    # encoding
    New-Variable -Name Base64Header -Value 0x0 -Option Constant
    New-Variable -Name Base64 -Value 0x1 -Option Constant
    New-Variable -Name Binary -Value 0x3 -Option Constant
    New-Variable -Name Base64RequestHeader -Value 0x4 -Option Constant
    # SANs
    New-Variable -Name OtherName -Value 0x1 -Option Constant
    New-Variable -Name RFC822Name -Value 0x2 -Option Constant
    New-Variable -Name DNSName -Value 0x3 -Option Constant
    New-Variable -Name DirectoryName -Value 0x5 -Option Constant
    New-Variable -Name URL -Value 0x7 -Option Constant
    New-Variable -Name IPAddress -Value 0x8 -Option Constant
    New-Variable -Name RegisteredID -Value 0x9 -Option Constant
    New-Variable -Name Guid -Value 0xa -Option Constant
    New-Variable -Name UPN -Value 0xb -Option Constant
    # installation options
    New-Variable -Name AllowNone -Value 0x0 -Option Constant
    New-Variable -Name AllowNoOutstandingRequest -Value 0x1 -Option Constant
    New-Variable -Name AllowUntrustedCertificate -Value 0x2 -Option Constant
    New-Variable -Name AllowUntrustedRoot -Value 0x4 -Option Constant
    # PFX export options
    New-Variable -Name PFXExportEEOnly -Value 0x0 -Option Constant
    New-Variable -Name PFXExportChainNoRoot -Value 0x1 -Option Constant
    New-Variable -Name PFXExportChainWithRoot -Value 0x2 -Option Constant
#endregion

#region Subject processing
    # http://msdn.microsoft.com/en-us/library/aa377051(VS.85).aspx
    $SubjectDN = New-Object -ComObject X509Enrollment.CX500DistinguishedName
    $SubjectDN.Encode($Subject, 0x0)
#endregion

#region Extensions

#region Enhanced Key Usages processing
    if ($EnhancedKeyUsage) {
        $OIDs = New-Object -ComObject X509Enrollment.CObjectIDs
        $EnhancedKeyUsage | ForEach-Object {
            $OID = New-Object -ComObject X509Enrollment.CObjectID
            $OID.InitializeFromValue($_.Value)
            # http://msdn.microsoft.com/en-us/library/aa376785(VS.85).aspx
            $OIDs.Add($OID)
        }
        # http://msdn.microsoft.com/en-us/library/aa378132(VS.85).aspx
        $EKU = New-Object -ComObject X509Enrollment.CX509ExtensionEnhancedKeyUsage
        $EKU.InitializeEncode($OIDs)
        $ExtensionsToAdd += "EKU"
    }
#endregion

#region Key Usages processing
    if ($KeyUsage) {
        $KU = New-Object -ComObject X509Enrollment.CX509ExtensionKeyUsage
        $KU.InitializeEncode([int]$KeyUsage)
        $KU.Critical = $true
        $ExtensionsToAdd += "KU"
    }
#endregion

#region Basic Constraints processing
    if ($PSBoundParameters.Keys.Contains("IsCA")) {
        # http://msdn.microsoft.com/en-us/library/aa378108(v=vs.85).aspx
        $BasicConstraints = New-Object -ComObject X509Enrollment.CX509ExtensionBasicConstraints
        if (!$IsCA) {$PathLength = -1}
        $BasicConstraints.InitializeEncode($IsCA,$PathLength)
        $BasicConstraints.Critical = $IsCA
        $ExtensionsToAdd += "BasicConstraints"
    }
#endregion

#region SAN processing
    if ($SubjectAlternativeName) {
        $SAN = New-Object -ComObject X509Enrollment.CX509ExtensionAlternativeNames
        $Names = New-Object -ComObject X509Enrollment.CAlternativeNames
        foreach ($altname in $SubjectAlternativeName) {
            $Name = New-Object -ComObject X509Enrollment.CAlternativeName
            if ($altname.Contains("@")) {
                $Name.InitializeFromString($RFC822Name,$altname)
            } else {
                try {
                    $Bytes = [Net.IPAddress]::Parse($altname).GetAddressBytes()
                    $Name.InitializeFromRawData($IPAddress,$Base64,[Convert]::ToBase64String($Bytes))
                } catch {
                    try {
                        $Bytes = [Guid]::Parse($altname).ToByteArray()
                        $Name.InitializeFromRawData($Guid,$Base64,[Convert]::ToBase64String($Bytes))
                    } catch {
                        try {
                            $Bytes = ([Security.Cryptography.X509Certificates.X500DistinguishedName]$altname).RawData
                            $Name.InitializeFromRawData($DirectoryName,$Base64,[Convert]::ToBase64String($Bytes))
                        } catch {$Name.InitializeFromString($DNSName,$altname)}
                    }
                }
            }
            $Names.Add($Name)
        }
        $SAN.InitializeEncode($Names)
        $ExtensionsToAdd += "SAN"
    }
#endregion

#region Custom Extensions
    if ($CustomExtension) {
        $count = 0
        foreach ($ext in $CustomExtension) {
            # http://msdn.microsoft.com/en-us/library/aa378077(v=vs.85).aspx
            $Extension = New-Object -ComObject X509Enrollment.CX509Extension
            $EOID = New-Object -ComObject X509Enrollment.CObjectId
            $EOID.InitializeFromValue($ext.Oid.Value)
            $EValue = [Convert]::ToBase64String($ext.RawData)
            $Extension.Initialize($EOID,$Base64,$EValue)
            $Extension.Critical = $ext.Critical
            New-Variable -Name ("ext" + $count) -Value $Extension
            $ExtensionsToAdd += ("ext" + $count)
            $count++
        }
    }
#endregion

#endregion

#region Private Key
    # http://msdn.microsoft.com/en-us/library/aa378921(VS.85).aspx
    $PrivateKey = New-Object -ComObject X509Enrollment.CX509PrivateKey
    $PrivateKey.ProviderName = $ProviderName
    $AlgID = New-Object -ComObject X509Enrollment.CObjectId
    $AlgID.InitializeFromValue(([Security.Cryptography.Oid]$AlgorithmName).Value)
    $PrivateKey.Algorithm = $AlgID
    # http://msdn.microsoft.com/en-us/library/aa379409(VS.85).aspx
    $PrivateKey.KeySpec = switch ($KeySpec) {"Exchange" {1}; "Signature" {2}}
    $PrivateKey.Length = $KeyLength
    # key will be stored in current user certificate store
    switch ($PSCmdlet.ParameterSetName) {
        '__store' {
            $PrivateKey.MachineContext = if ($StoreLocation -eq "LocalMachine") {$true} else {$false}
        }
        '__file' {
            $PrivateKey.MachineContext = $false
        }
    }
    $PrivateKey.ExportPolicy = if ($Exportable) {1} else {0}
    $PrivateKey.Create()
#endregion

    # http://msdn.microsoft.com/en-us/library/aa377124(VS.85).aspx
    $Cert = New-Object -ComObject X509Enrollment.CX509CertificateRequestCertificate
    if ($PrivateKey.MachineContext) {
        $Cert.InitializeFromPrivateKey($MachineContext,$PrivateKey,"")
    } else {
        $Cert.InitializeFromPrivateKey($UserContext,$PrivateKey,"")
    }
    $Cert.Subject = $SubjectDN
    $Cert.Issuer = $Cert.Subject
    $Cert.NotBefore = $NotBefore
    $Cert.NotAfter = $NotAfter
    foreach ($item in $ExtensionsToAdd) {$Cert.X509Extensions.Add((Get-Variable -Name $item -ValueOnly))}
    if (![string]::IsNullOrEmpty($SerialNumber)) {
        if ($SerialNumber -match "[^0-9a-fA-F]") {throw "Invalid serial number specified."}
        if ($SerialNumber.Length % 2) {$SerialNumber = "0" + $SerialNumber}
        $Bytes = $SerialNumber -split "(.{2})" | Where-Object {$_} | ForEach-Object {[Convert]::ToByte($_,16)}
        $ByteString = [Convert]::ToBase64String($Bytes)
        $Cert.SerialNumber.InvokeSet($ByteString,1)
    }
    if ($AllowSMIME) {$Cert.SmimeCapabilities = $true}
    $SigOID = New-Object -ComObject X509Enrollment.CObjectId
    $SigOID.InitializeFromValue(([Security.Cryptography.Oid]$SignatureAlgorithm).Value)
    $Cert.SignatureInformation.HashAlgorithm = $SigOID
    # completing certificate request template building
    $Cert.Encode()

    # interface: http://msdn.microsoft.com/en-us/library/aa377809(VS.85).aspx
    $Request = New-Object -ComObject X509Enrollment.CX509enrollment
    $Request.InitializeFromRequest($Cert)
    $Request.CertificateFriendlyName = $FriendlyName
    $endCert = $Request.CreateRequest($Base64)
    $Request.InstallResponse($AllowUntrustedCertificate,$endCert,$Base64,"")
    switch ($PSCmdlet.ParameterSetName) {
        '__file' {
            $PFXString = $Request.CreatePFX(
                [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($Password)),
                $PFXExportEEOnly,
                $Base64
            )
            Set-Content -Path $Path -Value ([Convert]::FromBase64String($PFXString)) -Encoding Byte
        }
    }
} # function New-SelfSignedCertificateEx

<#
.SYNOPSIS
Find a certificate associated with provided hostname.

.PARAMETER Hostname
Hostname to be searched in certificate subject.
#>
function FindCertificate
{
    param
    (
        [string] $Hostname
    )

    Get-ChildItem -Path Cert:\LocalMachine\My |
        Where-Object { $_.Subject -EQ "CN=$Hostname" } |
        Sort-Object -Descending NotBefore |
        Select-Object -First 1
}

<#
.SYNOPSIS
Generate a new self-signed certificate.

.PARAMETER DnsNames
One or more DNS names to put into the subject alternative name extension of the certificate.
The first DNS name is also saved as the Subject Name.
#>
function GenerateCertificate
{
    param
    (
        [string[]] $DnsNames
    )

    $cmd = Get-Command New-SelfSignedCertificate -ErrorAction Ignore
    if ($cmd -and $cmd.Parameters.KeyUsage) # Windows Server 2012 has the command, but it does not have necessary parameters.
    {
        # Server Authentication (1.3.6.1.5.5.7.3.1)
        # Client Authentication (1.3.6.1.5.5.7.3.2)
        # Document Encryption (1.3.6.1.4.1.311.80.1)

        $certificate = New-SelfSignedCertificate -DnsName $DnsNames -CertStoreLocation Cert:\LocalMachine\My `
            -KeyUsage 'DataEncipherment', 'KeyEncipherment', 'DigitalSignature' `
            -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.1,1.3.6.1.4.1.311.80.1")

        $certificateThumbprint = $certificate.Thumbprint
    }
    else # Windows Server 2008, 2008 R2, 2012, 2012 R2
    {
        $commonName = $DnsNames[0]
        $pfxFile = "$commonName.pfx"
        $password = New-Object System.Security.SecureString
        $password.AppendChar('_')

        New-SelfSignedCertificateEx -Subject "CN=$commonName" -SubjectAlternativeName $DnsNames `
            -Exportable -Password $password -Path $pfxFile `
            -KeyUsage 'DataEncipherment', 'KeyEncipherment', 'DigitalSignature' -EnhancedKeyUsage 'Server Authentication', 'Document Encryption' | Out-Null

        $result = certutil -p '_' -importpfx $pfxFile | Out-String
        if ($LASTEXITCODE)
        {
            Write-Error $result
            throw 'CertUtil failed.'
        }

        Remove-Item $pfxFile | Out-Null

        $existingCertificate = FindCertificate $commonName
        if ($existingCertificate)
        {
            $certificateThumbprint = $existingCertificate.Thumbprint
        }
        else
        {
            throw 'New certificate is not found.'
        }
    }

    $certificateThumbprint
}

<#
.SYNOPSIS
Configures server to accept WinRM connections over HTTPS.

.DESCRIPTION
Generates self-signed certificate or uses existing. Configures HTTPS listener for WinRM service. Opens 5986 port in firewall.

.PARAMETER CertificateThumbprint
Certificate thumbprint to be used for securing the connection.

.PARAMETER Force
If specified, all required properties will be re-installed instead of reusing existing.

.PARAMETER AlternativeDnsNames
Alternative DNS names to be registered with new certificate (if certificate thumbprint was not provided).

.NOTES
For Windows Server 2008 and 2008 R2 you should execute following statement to disable remote UAC:
Set-ItemProperty –Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System –Name LocalAccountTokenFilterPolicy –Value 1 –Type DWord
Restart-Computer
#>
function Install-WinrmHttps
{
    [Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSUseSingularNouns", "",
                                                       Scope="Function", Target="*")]

    [CmdletBinding()]
    param
    (
        [string] $CertificateThumbprint,
        [switch] $Force,
        [String[]] $AlternativeDnsNames
    )

    Get-CallerPreference -Cmdlet $PSCmdlet -SessionState $ExecutionContext.SessionState

    if (!$PSBoundParameters.ContainsKey('InformationAction'))
    {
        [Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSUseDeclaredVarsMoreThanAssignment", "")]
        $InformationPreference = 'Continue'
    }

    $fqdn = [System.Net.Dns]::GetHostByName('localhost').Hostname
    $computerName = $env:COMPUTERNAME

    $dnsNames = @($fqdn)
    if ($fqdn -ne $computerName)
    {
        $dnsNames += $computerName
    }

    if ($AlternativeDnsNames)
    {
        $dnsNames += $AlternativeDnsNames
    }

    if (!$CertificateThumbprint)
    {
        $existingCertificate = FindCertificate $fqdn
        if ($existingCertificate -and !$Force)
        {
            $CertificateThumbprint = $existingCertificate.Thumbprint
            Write-Information 'Using existing certificate...'
        }
        else
        {
            $CertificateThumbprint = GenerateCertificate $dnsNames
            Write-Information 'New certificate is generated.'
        }
    }

    $existingListener = Get-ChildItem WSMan:\localhost\Listener |
        Where-Object { $_.Keys[0] -eq 'Transport=HTTPS' }

    if ($existingListener)
    {
        Write-Information 'Listener already exists.'
        if ($Force)
        {
            Write-Information 'Reinstalling...'
            Remove-Item "WSMan:\localhost\Listener\$($existingListener.Name)" -Recurse | Out-Null
            $existingListener = $null
        }
    }

    if (!$existingListener)
    {
        New-Item -Path WSMan:\localhost\Listener -Address * -Transport HTTPS `
            -CertificateThumbprint $CertificateThumbprint -Force | Out-Null
        Write-Information 'New listener is created.'
    }

    # Create required properties in registry.
    Repair-SslBindings

    try
    {
        $cmd = Get-Command New-NetFirewallRule -ErrorAction Ignore
        $ruleName = 'Windows Remote Management (HTTPS-In)'
        $port = 5986

        if ($cmd)
        {
            New-NetFirewallRule -DisplayName $ruleName -Direction Inbound -Action Allow -Protocol TCP -LocalPort $port -ErrorAction Stop | Out-Null
        }
        else
        {
            netsh advfirewall firewall add rule name=$ruleName protocol=TCP dir=in localport=$port action=allow
            if ($LASTEXITCODE)
            {
                throw 'Netsh failed.'
            }
        }

        Write-Information 'Firewall rule is updated.'
    }
    catch [Microsoft.Management.Infrastructure.CimException]
    {
        if ($_.Exception.HResult -eq 0x80131500)
        {
            Write-Information 'Windows Firewall is not enabled.'
        }
        else
        {
            throw
        }
    }

    Write-Information "`nWinRM is set up for DNS names:"
    Write-Information ($dnsNames | Out-String)
}

<#
.SYNOPSIS
Creates a new directory in remote server's %TEMP%.

.DESCRIPTION
Creates a new directory in remote server's %TEMP%.
The result of current cmdlet will be resulting folder's location.

.PARAMETER Session
Session to be used to access the computer's temp folder.
#>
function Get-RemoteTempPath
{
    [CmdletBinding()]
    param
    (
        [Parameter(Mandatory = $true)]
        [System.Management.Automation.Runspaces.PSSession] $Session
    )

    Get-CallerPreference -Cmdlet $PSCmdlet -SessionState $ExecutionContext.SessionState

    Invoke-Command -Session $Session -ScriptBlock `
        {
            $tempPath = "$env:TEMP\" + [guid]::NewGuid()
            New-Item $tempPath -ItemType Directory -ErrorAction Stop | Out-Null
            $tempPath
        }
}

<#
.SYNOPSIS
Fixes 'Failed to enumerate SSL bindings, error code 234' error.
#>
function Repair-SslBindings
{
    [Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSUseSingularNouns", "",
                                                       Scope="Function", Target="*")]

    [CmdletBinding()]
    param ()

    Get-ChildItem HKLM:\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\SslBindingInfo | ForEach-Object `
        {
            $storeName = Get-ItemProperty -Path $_.PSPath -Name 'SslCertStoreName' -ErrorAction SilentlyContinue
            if (!$storeName)
            {
                Set-ItemProperty -Path $_.PSPath -Name 'SslCertStoreName' -Value 'My'
                Write-Information "Updated SslCertStoreName property for $($_.PSChildName) binding."
            }
        }
}
