To clarify/simplify and merge the instructions above for workstations using Windows:

To simplify the instructions in both the .bat file and the sbulletsupport topics:

1. Download OpenSSL

The following link should have what you need. You need to select 
==> https://slproweb.com/products/Win32OpenSSL.html

Assuming you are on a 64bit machine, the option "Windows64 OpenSSL v3.0.0" in the list, should be what you download (https://slproweb.com/download/Win64OpenSSL-3_0_0.exe)

2. Once you download, please follow the instructions and install the binaries on your machine.

3. Once everything is installed, create a new directory at a convenient place. Copy and paste the following files from following locations into this newly created directory:

==> From the OpenSSLCreateCertMacWin folder that you downloaded and extracted from sbulletsupport website
- CreateWindowsCertificate.bat
-v3.ext

==> From the C:\Program Files\OpenSSL-Win64\bin (unless you installed the open SSL at a different location)

-openSSL.exe


4. If you do have an existing configuration file for creating OpenSSL certificates, pls provide access to that in the .bat file (right click and edit the .bat file and set the OPENSSLCONFIG= option to point to the right location)

If you DO NOT HAVE one, the batch file will create one for you during execution (Command Prompt). Edit/Delete the OPENSSLCONFIG= option off the .bat file.

Per comments in the .bat file:

==> Common Name (CN) specified in this step should be 127.0.0.1, or the CN must match the wss address used by the app.
Example:
Country Name: US
State: Florida
Locality: Pensacola
Organization: Example Company
Unit Name: EC
Common Name: 127.0.0.1
Email: support@examplecompany.com

==> you can just press enter and skip for "extra" attributes


5. Double check to make sure you have all 3 files needed in the same directory (createWindowsCertificate.bat,v3.ext,openssl.exe) and run the .bat file in command prompt like (createWindowsCertificate.bat) and follow/fillout the attributes.

All necessary certificates will be created.

Once created, all you need to do is to make sure the certificates files are in the same directory as the Ranger Remote installer, and during Ranger Remote installation you choose the wss install option.

This vulnerability has been addressed by SBT.  Please refer to the following information below to make necessary Ranger updates to prevent this vulnerability on workstations:

1. SBTLogServiceWindows is already a deprecated service. No Ranger Core installer newer than 4.5.x.x should install this service.This Service path will linger even after uninstalling the old plugins, but you can safely delete this service path (without affecting SBTLogService)

2. All other Services Ranger installs have also been certified for quoted paths starting from Ranger Core 4.8.1.6-X.X.X.X. Ranger Core before 4.8.1.6 might install SBT Log Service with an unquoted path.

3. Ranger Remote Service installers starting from 2.2.1.7 will also not install any services with an unquoted path


You can read more about this vulnerability here:
https://medium.com/@harshaunsingh/windows-privileged-escalation-manual-and-using-metasploit-framework-ch-1-fd5f31a7db86

RangerForCanon-CR50CR80CRL1-4.9.4.0-2.1.0.8 is here!