How to reflect the use of a custom cert in an unattended setup of FIM R2 SP1 Portal & Service?

Question

Hi,
When doing an
unattended installation of FIM Portal & Service there is a parameter that indicates the certificate subject name to generate: 'CERTIFICATE_NAME'.
But, the GUI-based setup shows a choice:
Select a certificate located in the local certificate store
Generate a new self-issued certificate
How do I accomplish a selection from the local certificate store through an unattended install?
It seems that for instance using 'CERTIFICATE_NAME=MyCustomFIMCert' does not search the store first but creates an additional self-issued certificate with exactly the same name; in the msi installer log it then complaints that the installer
found certificates with the same name.
Anyone any tips how to deal with this behavior?
THANKS :-)
Danny Alvares, Senior Technology Consultant

Answer 1

Here's the full PowerShell script.
# FIM Service & Portal MSI & Setup# See: http://technet.microsoft.com/en-us/library/hh322863(v=ws.10).aspx
$FIMServicePortalMsi = "`"C:\FIMSetup\Service and Portal\Service and Portal.msi`""
$FIMServicePortalInstallDir = "`"C:\Program Files\Microsoft Forefront Identity Manager\2010`""
$FIMServicePortalSetupLog = "`"C:\FIMSetup\FIMServicePortalSetup_Log.txt`""
$FIMServiceCustomCertificateName = "fimservice.domain.local"
$FIMADDLOCAL = "CommonServices,WebPortals"
$FIMSQMOPTINSETTING = 0
$FIMSQLSERVER_SERVER = "dbFIMService" # REQUIRED
$FIMSQLSERVER_DATABASE = "FIMService"
$FIMEXISTINGDATABASE = 0
$FIMMAIL_SERVER = "exch.domain.local" # REQUIRED
$FIMMAIL_SERVER_USE_SSL = 0
$FIMMAIL_SERVER_IS_EXCHANGE = 1
$FIMPOLL_EXCHANGE_ENABLED = 0
# $FIMCERTIFICATE_NAME = "ForefrontIdentityManager" # IMPORTANT: WHEN USING A CUSTOM CERTIFICATE USE THUMBPRINT
$FIMCERTIFICATE_THUMBPRINT = (dir Cert:\LocalMachine\My | where {$_.subject -match $FIMServiceCustomCertificateName}).thumbprint
$FIMSERVICE_ACCOUNT_NAME = "svcFIMservice" # REQUIRED
$FIMSERVICE_ACCOUNT_PASSWORD = "********" # REQUIRED
$FIMSERVICE_ACCOUNT_DOMAIN = "DOMAIN" # REQUIRED
$FIMSERVICE_ACCOUNT_EMAIL = "[email protected]" # REQUIRED
$FIMSERVICE_MANAGER_SERVER = "" # FIM Reporting Service Management Server
$FIMSYNCHRONIZATION_SERVER = "fimsync.domain.local" # REQUIRED
$FIMSYNCHRONIZATION_SERVER_ACCOUNT = "DOMAIN\svcFIMsyncservice"
$FIMSERVICEADDRESS = "fimservice.domain.local" # DO NOT USE LOCALHOST OR HTTP(S) PREFIX
$FIMSHAREPOINT_URL = "https://fimportal.domain.local"
$FIMREGISTRATION_PORTAL_URL = ""
$FIMFIREWALL_CONF = 1 # Ports 5725, 5726
$FIMSHAREPOINTUSERS_CONF = 1
$FIMREQUIRE_REGISTRATION_INFO = 0
$FIMREGISTRATION_ACCOUNT_NAME = ""
$FIMREGISTRATION_ACCOUNT_DOMAIN = ""
$FIMREQUIRE_RESET_INFO = 0
$FIMRESET_ACCOUNT_NAME = ""
$FIMRESET_ACCOUNT_DOMAIN = ""
#MSI Argument list
$FIMArguments = @("/i", $FIMServicePortalMsi, "/qn", "INSTALLDIR=$FIMServicePortalInstallDir", "ADDLOCAL=$FIMADDLOCAL", "SQMOPTINSETTING=$FIMSQMOPTINSETTING", "SQLSERVER_SERVER=$FIMSQLSERVER_SERVER", "SQLSERVER_DATABASE=$FIMSQLSERVER_DATABASE", "EXISTINGDATABASE=$FIMEXISTINGDATABASE", "MAIL_SERVER=$FIMMAIL_SERVER", "MAIL_SERVER_USE_SSL=$FIMMAIL_SERVER_USE_SSL", "MAIL_SERVER_IS_EXCHANGE=$FIMMAIL_SERVER_IS_EXCHANGE", "POLL_EXCHANGE_ENABLED=$FIMPOLL_EXCHANGE_ENABLED", "CERTIFICATE_THUMBPRINT=$FIMCERTIFICATE_THUMBPRINT", "SERVICE_ACCOUNT_NAME=$FIMSERVICE_ACCOUNT_NAME", "SERVICE_ACCOUNT_PASSWORD=$FIMSERVICE_ACCOUNT_PASSWORD", "SERVICE_ACCOUNT_DOMAIN=$FIMSERVICE_ACCOUNT_DOMAIN", "SERVICE_ACCOUNT_EMAIL=$FIMSERVICE_ACCOUNT_EMAIL", "SERVICE_MANAGER_SERVER=$FIMSERVICE_MANAGER_SERVER", "SYNCHRONIZATION_SERVER=$FIMSYNCHRONIZATION_SERVER", "SYNCHRONIZATION_SERVER_ACCOUNT=$FIMSYNCHRONIZATION_SERVER_ACCOUNT", "SERVICEADDRESS=$FIMSERVICEADDRESS", "SHAREPOINT_URL=$FIMSHAREPOINT_URL", "REGISTRATION_PORTAL_URL=$FIMREGISTRATION_PORTAL_URL", "FIREWALL_CONF=$FIMFIREWALL_CONF", "SHAREPOINTUSERS_CONF=$FIMSHAREPOINTUSERS_CONF", "REQUIRE_REGISTRATION_INFO=$FIMREQUIRE_REGISTRATION_INFO", "REGISTRATION_ACCOUNT_NAME=$FIMREGISTRATION_ACCOUNT_NAME", "REGISTRATION_ACCOUNT_DOMAIN=$FIMREGISTRATION_ACCOUNT_DOMAIN", "REQUIRE_RESET_INFO=$FIMREQUIRE_RESET_INFO", "RESET_ACCOUNT_NAME=$FIMRESET_ACCOUNT_NAME", "RESET_ACCOUNT_DOMAIN=$FIMRESET_ACCOUNT_DOMAIN", "/l*", $FIMServicePortalSetupLog)Clear-Host
"Installing FIM Portal & Service..."
$InstallExitCode = (Start-Process -FilePath msiexec.exe -ArgumentList $FIMArguments -Wait -Passthru).ExitCodeif ($InstallExitCode -eq 0) {"Installation successful."}else {"Installation failed with code $InstallExitCode. Check Windows Event Viewer for errors."}
Danny Alvares, Senior Technology Consultant