Content Comparison

Skip to the second section if submitting an existing certificate request.

Create the certificate request

...

Log into a server joined to the Austin Active Directory as a user with permissions to request a certificate from the desired template

...

Open an administrative PowerShell prompt

...

In the same administrative PowerShell prompt, navigate to the location where the certificate request should be created: 

#example
Set-Location C:\Working

In the same administrative PowerShell prompt, run the following command to set the subject, any optional DNS or IP Address subject alternate names, and template of the certificate:  

...

Define the certificate subject and subject alternative names

1. Sign in to a computer then start an administrative PowerShell session 

2. Modify then run the following commands to set the subject and template of the certificate as well as any optional DNS or IP Address subject alternate name values:  

   Code Block
   language powershell
   $Subject = "<subject for the certificate>"

...

1. $SubjectAlternateNames = @("<certificate SAN #1>","<certificate SAN #2>",...)

...

1. $CertificateIPAddresses = @("<certificate IP address #1>","<certificate IP address #2>",...)

In the same administrative PowerShell session, run one of the following:

...

Create the certificate request

1. Run the following commands to define the newline string: 

   Code Block

...

1. language powershell
   $NewLine =

...

1. [System.Environment]::NewLine

2. Run the following commands to create the temporary files: 

   Code Block

...

1. language powershell

   $CertificateTemplateFile =

...

1. New-TemporaryFile $CertificateRequestFile = New-TemporaryFile

2. Run the following commands to define the certificate template:

   Code Block
   language powershell
   $CertificateTemplate = @' [Version] Signature=

...

1. "

...

1. $Windows

...

1. NT$" [NewRequest] Subject=

...

1. "CN=

...

1. %Subject%" Exportable=TRUE MachineKeySet=TRUE KeyLength=2048 KeySpec=AT_KEYEXCHANGE [Extensions] 2.5.29.17=

...

1. "{text}

...

1. " _continue_=

...

1. "DNS=

...

1. %Subject%&

...

1. "

...

1. '@

2. Run the following commands to update the subject in the certificate template: 

   Code Block
   language powershell
   $CertificateTemplate = $CertificateTemplate.Replace('%Subject%', $Subject)

3. Run the following commands to add any optional DNS subject alternate names to the

...

1. certificate template: 

   Code Block
   language powershell
   ForEach (

...

1. $SubjectAlternateName in

...

1. $SubjectAlternateNames) {

...

1. $CertificateTemplate = '{0}{1}_continue_=

...

1. "DNS=

...

1. {2}&

...

1. "' -f $CertificateTemplate, $NewLine, $SubjectAlternateName }

2. Run the following commands to add any optional IP Address subject alternate names to the

...

1. certificate template: 

   Code Block
   language powershell
   ForEach (

...

1. $CertificateIPAddress in

...

1. $CertificateIPAddresses) {

...

1. $CertificateTemplate = '{0}{1}_continue_=

...

1. "IPAddress=

...

1. {2}&

...

In the same administrative PowerShell prompt, run the following to create the request:

$cert_file_req = ((Get-Location).Path + "\" + $cert_file  + ".req")
$cert_file_cer = ((Get-Location).Path + "\" + $cert_file  + ".cer")
certreq -new $cert_file_inf $cert_file_req

Submit the certificate request

...

• $cert_file_req  - the full path to the certificate request file
• $cert_file_cer - the full path to the certificate that will be created

...

In the same administrative PowerShell session, run one of the following to set the certificate template:

• For VMware SSL certificates, run the following: 

  Code Block
  $cert_template = "VMwareSSL6.5"

• For long-duration server certificates, run the following: 

  Code Block
  $cert_template = "Server-10Year"

In the same administrative PowerShell prompt, run the following to submit the request to a certificate authority then accept the response: 

...

1. "' -f $CertificateTemplate, $NewLine, $CertificateIPAddress }

2. Run the following commands to trim the certificate template:

   Code Block
   language powershell
   $CertificateTemplate = $CertificateTemplate -replace '&"\s*$', '"'

3. Run the following commands to write the certificate template file:

   Code Block
   language powershell
   $Content | Out-File -FilePath $CertificateTemplateFile -Force

4. Run the following commands to review the certificate template file: 

   Code Block
   language powershell
   Get-Content -Path $CertificateTemplateFile

5. Run the following commands to create the certificate request file:

   Code Block
   language powershell
   certreq -new -f $CertificateTemplateFile $CertificateRequestFile

6. Run the following commands to review the certificate request file: 

   Code Block
   language powershell
   Get-Content -Path $CertificateRequestFile

7. Run the following commands to retrieve the certificate request file name: 

   Code Block
   language powershell
   Get-Item -Path $CertificateRequestFile

Submit the certificate request to a certificate authority

• To submit the certificate request to the preferred InCommon certificate authority, review and complete the SSL Request form in ServiceNow 

• To submit the certificate request to the internal Austin certificate authority, complete the instructions on the following page: Austin Certificates - How-To - Submit custom certificates requests

References

• Certreq - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certreq_1