Sophos XG API / Lets Encrypt / PowerShell 7 / WAF Update

#Manual Request for Certificates Handled As a Manual Process

#Vars
$DateMonthFormat = (Get-Date -Format MM_yy)
$uri = "https://<sophosxg>:4444/webconsole/APIController"

#PasswordState Vars
$apikey = ""
$PasswordStateServer = ""
$PasswordID = ""
$SearchURI = $PasswordStateServer + "/api/passwords/" + $PasswordID + "?apikey=" + $APIKey
$JsonObject = Invoke-WebRequest -Uri $SearchURI
$Username = ($JsonObject.Content | ConvertFrom-Json).username
$Password = ($JsonObject.Content | ConvertFrom-Json).GenericField1 #Encypted Password

#Get Current Certificates
$Orders = Get-PAOrder -List
$Orders = $Orders | Where-Object { $_.name -match "<yourfilter>" } 

#Used for Cleanup
$ArrWAFObj = @()
$ArrEXPCertObj = @()

foreach ($Order in $Orders)
{
	#Renew Certificate
	Get-PAOrder -MainDomain $Order.MainDomain | Submit-Renewal -WarningAction Stop #Stops Script Running if the Renewal is not required (for scheduled task to run daily)

    #Install Chain Certifcate Sophos XG
    $CACertName = "R3"
    $CertFilename = "fullchain.pfx"
    
    $request = "<Request><Login><Username>$Username</Username><Password passwordform=`"encrypt`">$Password</Password></Login><Set operation=`"add`"><Certificate><Action>UploadCertificate</Action><Name>$CACertName</Name><CertificateFormat>pkcs12</CertificateFormat><CertificateFile>$CertFilename</CertificateFile><Password>poshacme</Password></Certificate></Set></Request>"
    
    $CertfileProd = (Get-ChildItem $Order.Folder -Filter $CertFilename)[0].fullname
    $Form = @{
        reqxml = $request
        $((Get-Item $CertfileProd).Basename) = Get-Item -Path $CertfileProd
    }
    $Result = Invoke-RestMethod -Uri $Uri -form $form -SkipCertificateCheck
    $StatusCode = $Result.Response.Certificate.Status
    
    if ($StatusCode.Code -eq "200")
    {
        #Cleanup R3 Cert that is installed along with CA
        $request = "<Request><Login><Username>$Username</Username><Password passwordform=`"encrypt`">$Password</Password></Login><Remove><Certificate><Name>$CACertName</Name></Certificate></Remove></Request>"
        $Form = @{
            reqxml = $request
        }
        $Result = Invoke-RestMethod -Uri $Uri -form $form -SkipCertificateCheck
        $Statuscode = $Result.Response.Certificate.Status
    }
    
    if ($StatusCode -ne "200")
    {
        #Install New Certificate on Sophos XG
        $CertPreFix = $DateMonthFormat + "_"
        $CertPostFix = "_LE"
        $CertCN = $Order.FriendlyName
        $CertName = $CertPreFix + $CertCN + $CertPostFix
        
        $request = "<Request><Login><Username>$Username</Username><Password passwordform=`"encrypt`">$Password</Password></Login><Set operation=`"add`"><Certificate><Action>UploadCertificate</Action><Name>$CertName</Name><CertificateFormat>pkcs12</CertificateFormat><CertificateFile>cert.pfx</CertificateFile><Password>poshacme</Password></Certificate></Set></Request>"
        $PFXfileProd = (Get-ChildItem $Order.Folder -Filter cert.pfx)[0].fullname
        $Form = @{
            reqxml = $request
            $((Get-Item $PFXfileProd).Basename) = Get-Item -Path $PFXfileProd
        }
        $Result = Invoke-RestMethod -Uri $Uri -form $form -SkipCertificateCheck
    }

	#Get WAF with matching Domain/Certificate CN
	$request = "<Request><Login><Username>$Username</Username><Password passwordform=`"encrypt`">$Password</Password></Login><Get><FirewallRule></FirewallRule></Get></Request>"
	
	$Form = @{
		reqxml = $request
	}
	
	$Result = (Invoke-RestMethod -Uri $Uri -form $form -SkipCertificateCheck)

	$Result.Response.FirewallRule | Where-Object PolicyType -eq 'HTTPBased' | ForEach-Object {
		$Domain = $_.HTTPBasedPolicy.Domains.Domain

        #Cycle through each matching domain/cert that replace certificate
		if ($Domain -eq $CertCN)
		{
			$ArrWAFObj += $_.name
			$ArrEXPCertObj += $_.HTTPBasedPolicy.Certificate
			$XmLObj = $_
			[String]$XmL = $XmLObj.OuterXml -replace ' transactionid\=\"\"', '' -replace "\<Certificate\>*.*\<\/Certificate\>", "<Certificate>$CertName</Certificate>" # Update xml with new certificate name.
			
			$PrefixSetReq = "<Request><Login><Username>$Username</Username><Password passwordform=`"encrypt`">$Password</Password></Login><Set operation=`"Update`">"
			$PostfixSetReq = "</Set></Request>"
			$request = $PrefixSetReq + $XmL + $PostfixSetReq
			
			$Form = @{
				reqxml = $request
			}
			
			$Result = (Invoke-RestMethod -Uri $Uri -form $form -SkipCertificateCheck)
			$StatusCode = $Result.Response.FirewallRule.Status			
		}
	}
}


#Move Rule back to WAF FirewallRuleGroup
$request = "<Request><Login><Username>$Username</Username><Password passwordform=`"encrypt`">$Password</Password></Login><Get><FirewallRuleGroup></FirewallRuleGroup></Get></Request>"
			
$Form = @{
    reqxml = $request
}

$Result = (Invoke-RestMethod -Uri $Uri -form $form -SkipCertificateCheck)

($Result.Response.FirewallRuleGroup | Where-Object Name -eq 'WAFs') | ForEach-Object {
    $XmLObj = $_
    [String]$XmL = $XmLObj.OuterXml -replace ' transactionid\=\"\"', ''
    [xml]$xml = $XmL
    
    Foreach ($WAF in $ArrWAFObj)
    {
        $Item = Select-Xml -xml $XmL -XPath '//FirewallRuleGroup/SecurityPolicyList/SecurityPolicy[1]'
        $newnode = $item.Node.CloneNode($true)
    

        $newnode.'#text' = $WAF
        $SecurityPolicyList = Select-Xml -Xml $xml -XPath '//FirewallRuleGroup/SecurityPolicyList'
        $SecurityPolicyList.node.AppendChild($newnode)
    }
    
    [String]$xml = $xml.OuterXml
    
    $PrefixSetReq = "<Request><Login><Username>$Username</Username><Password passwordform=`"encrypt`">$Password</Password></Login><Set operation=`"Update`">"
    $PostfixSetReq = "</Set></Request>"
    $request = $PrefixSetReq + $XmL + $PostfixSetReq
    
    $Form = @{
        reqxml = $request
    }
    
    $Result = (Invoke-RestMethod -Uri $Uri -form $form -SkipCertificateCheck)
    $StatusCode = $Result.Response.FirewallRuleGroup.Status
}

# Delete Old Certificate # Can skip this - Cert migth be used elsewhere and could fail - also maybe good to be able to fallback to old cert.
$EXPCerts = $ArrEXPCertObj | Select-Object -Unique

foreach ($ExpCert in $EXPCerts){
    $request = "<Request><Login><Username>$Username</Username><Password passwordform=`"encrypt`">$Password</Password></Login><Remove><Certificate><Name>$ExpCert</Name></Certificate></Remove></Request>"
    $Form = @{
        reqxml = $request
    }
    $Result = Invoke-RestMethod -Uri $Uri -form $form -SkipCertificateCheck
    $Result.Response.Certificate.Status   
}