| Table of Contents | ||
|---|---|---|
|
Skip ahead to the Submit the certificate request section for an existing certificate request.
Prerequisites
- For Austin CA certificates, the computer referenced in the following instructions must have Enroll permissions for the requested certificate template
- Contact the AD team for assistance with certificate template permissions
Define the certificate subject and subject alternative names
Sign in to a computer
...
then start
...
an administrative PowerShell session
...
...
Complete any remaining instructions in this PowerShell session unless directed otherwise
Modify then run the following commands to set the subject and template of the certificate as well as any optional DNS or IP Address subject alternate name values:
Code Block
...
language powershell $Subject =
...
"<subject for the certificate>"
...
$SubjectAlternateNames = @("<certificate SAN #1>","<certificate SAN #2>",...)
...
$CertificateIPAddresses = @("<certificate IP address #1>","<certificate IP address #2>",...)
Create the certificate request
...
Run the following commands to define the newline string:
Code Block language powershell $NewLine = [System.Environment]::NewLineRun the following commands to create the temporary files
...
:
Code Block
...
language powershell $CertificateTemplateFile = New-TemporaryFile
...
$CertificateRequestFile = New-TemporaryFile
Run the following commands to
...
define the certificate
...
template:
Code Block
...
language powershell $CertificateTemplate = @
...
' [Version] Signature=
...
"
...
$Windows
...
NT$" [NewRequest] Subject=
...
"CN=
...
%Subject%" Exportable=TRUE MachineKeySet=TRUE KeyLength=2048 KeySpec=AT_KEYEXCHANGE [Extensions] 2.5.29.17=
...
"{text}
...
" _continue_=
...
"DNS=
...
%Subject%&
...
"
...
'@Run the following commands to update the subject in the certificate template:
Code Block language powershell $CertificateTemplate = $CertificateTemplate.Replace('%Subject%', $Subject)Run the following commands to add any optional DNS subject alternate names to the certificate
...
template:
Code Block language powershell ForEach (
...
$SubjectAlternateName in
...
$SubjectAlternateNames) {
...
$CertificateTemplate = '{0}{1}_continue_=
...
"DNS=
...
{2}&
...
"' -f $CertificateTemplate, $NewLine, $SubjectAlternateName }
Run the following commands to add any optional IP Address subject alternate names to the certificate
...
template:
Code Block language powershell ForEach (
...
$CertificateIPAddress in
...
$CertificateIPAddresses) {
...
$CertificateTemplate = '{0}{1}_continue_=
...
"IPAddress={2}&"' -f $CertificateTemplate, $NewLine, $CertificateIPAddress }Run the following commands to trim the certificate template:
Code Block language powershell $CertificateTemplate = $CertificateTemplate -replace '&"\s*$', '"'Run the following commands to write the certificate template file:
Code Block language powershell $Content | Out-File -FilePath $CertificateTemplateFile -ForceRun the following commands to review the certificate template file:
Code Block language powershell Get-Content -Path $CertificateTemplateFileRun the following commands to create the certificate request file:
Code Block language powershell certreq -new
...
-f $CertificateTemplateFile $CertificateRequestFileRun the following commands to review the certificate request file:
Code Block language powershell Get-Content
...
-Path $CertificateRequestFileRun the following commands to retrieve the certificate request file name:
Code Block language powershell Get-Item
...
-Path $CertificateRequestFile
Submit the certificate request to a certificate authority
To submit the certificate request to
...
the preferred InCommon certificate authority, review and complete the SSL Request form in ServiceNow
...
To submit the certificate request to
...
the internal Austin certificate authority, complete the instructions on the following
...
Accept the certificate request
...
- Ensure the certificate is on or accessible by the system that created the original certificate request
- Log into the system that created the original certificate request
- Start an administrative PowerShell session and set the $cert_file_cer object to the full path of the signed certificate file that will be accepted
In the same administrative PowerShell prompt, run the following to accept the response:
...