PowerShell Script: Automatic Certificate Creation & Renewal

<#
Use Posh-ACME module to renew a certificate using DNS provider's API. Also perform specific set of tasks for services which do not properly support cert auto renewal.

Pseudocode:
- Create/Set server to right Posh-ACME account (Prod or Stage)
- Create new account under current ACME server if one doesnt exist already
- If certificate already exists, try to renew it if it's within 30 days of expiry. If renewed, run Invoke-PostRenewalTask.
- If certificate doesnt exist, try to obtain it and then run Invoke-PostRenewalTask

Invoke-PostRenewalTask: Your code/script that will run if certificate gets created or renewed.
#>

$hostname = "host1.example.com"
$email = "[email protected]"
$PAenv = "LE_PROD" # Use LE_STAGE for testing, LE_PROD for live environment

# CloudFlare API - More supported providers here: https://poshac.me/docs/v4/Plugins/
$plugin = "CloudFlare"
$pArgs = @{
    CFToken = 'your-api-token-here'
}

############### POST RENEWAL TASK FUNCTION #####################################################
# This function will only run if the cert is renewed or created
function Invoke-PostRenewalTask
{
    Write-Host "This function was executed as a certificate creation or a valid renewal was detected."
    ### PLACE YOUR OWN SCRIPT/CODE HERE
    ### EXAMPLE: Update certificate on IIS server
    ### EXAMPLE: Update certificate for Nginx and reload service
}
############### END OF POST RENEWAL TASK FUNCTION ##############################################

# Download Posh-ACME PowerShell module if it isn't installed already
if (Get-Module -ListAvailable -Name Posh-ACME)
{
    Write-Host "Posh-ACME Powershell module exists. Continuing..." -ForegroundColor Green
} 
else
{
    Write-Host "Posh-ACME Powershell module does not exist. Installing it now (THIS WILL TAKE A FEW MINUTES)." -ForegroundColor Yellow
    Install-Module Posh-ACME -Scope CurrentUser -Force -Confirm:$false
}

Import-Module Posh-ACME

# Ensure the server is configured and also set the right PA account (prod or staging)
if (-not ($PAServer = Get-PAServer $PAenv))
{
    try
    {
        Write-Host "No ACME server found, setting it up now." 
        Set-PAServer $PAenv
        Write-Host "PAServer environment: $PAenv"
    }
    catch
    {
        Write-Host "Error setting up PA server."
        Write-Host "Error: $($_.Exception.Message)" -ForegroundColor Red
    }
}
else
{
    Set-PAServer $PAenv
    Write-Host "PAServer environment: $PAenv"
}

# Configure account under Posh-ACME if this step isnt already done
$accountCheck = Get-PAAccount
if (-not $accountCheck)
{
    Write-Host "No account found, creating new account."
    $accountCheck = New-PAAccount -AcceptTOS -Contact $email
}

# Check if cert already exists
$cert = Get-PACertificate -Name $hostname
if (-not $cert) # Get new cert if it doesnt exist, then run post renewal task
{
    Write-Host "$hostname doesnt exist! Requesting a new cert. This can take a few minutes."
    try
    {
        $newRequest = New-PACertificate $hostname -Plugin $plugin -AcceptTOS -PluginArgs $pArgs -Contact $email
        $newRequest

        Invoke-PostRenewalTask
    }
    catch
    {
        Write-Host "Error: $($_.Exception.Message)" -ForegroundColor Red
    }
}
else
{
    Write-Host "Cert order already exists for $hostname"
}

# Renew cert if expiring in next 30 days
$cert = Get-PACertificate -Name $hostname
$renewalThreshhold = (Get-Date).AddDays(30)

if ($cert.NotAfter -le $renewalThreshhold)
{
    
    Write-Host "$hostname cert expires in the next 30 days $($cert.NotAfter), Starting renewal process."
    Submit-Renewal -MainDomain $hostname -Verbose

    # If renewed, perform the following post-renewal tasks
    Invoke-PostRenewalTask

}
else
{
    $daysLeft = ($cert.NotAfter - (Get-Date)).Days
    Write-Host "$hostname cert renewal not needed. $daysLeft days still remaining for existing cert."
}