Define the certificate subject and subject alternative names

  1. Sign in to a computer then start an administrative PowerShell session 

  2. Modify then run the following commands to set the subject and template of the certificate as well as any optional DNS or IP Address subject alternate name values:  

    $Subject = "<subject for the certificate>"
$SubjectAlternateNames = @("<certificate SAN #1>","<certificate SAN #2>",...)
$CertificateIPAddresses = @("<certificate IP address #1>","<certificate IP address #2>",...)

Create the certificate request

  1. Run the following commands to define the newline string: 

    $NewLine = [System.Environment]::NewLine

  2. Run the following commands to create the temporary files: 

    $CertificateTemplateFile = New-TemporaryFile
$CertificateRequestFile = New-TemporaryFile

  3. Run the following commands to define the certificate template:

    $CertificateTemplate = @'
[Version]
Signature="$Windows NT$"
  
[NewRequest]
Subject="CN=%Subject%"
Exportable=TRUE
MachineKeySet=TRUE
KeyLength=2048
KeySpec=AT_KEYEXCHANGE
  
[Extensions]
2.5.29.17="{text}"
_continue_="DNS=%Subject%&"
'@

  4. Run the following commands to update the subject in the certificate template: 

    $CertificateTemplate = $CertificateTemplate.Replace('%Subject%', $Subject)

  5. Run the following commands to add any optional DNS subject alternate names to the certificate template: 

    ForEach ($SubjectAlternateName in $SubjectAlternateNames) { $CertificateTemplate = '{0}{1}_continue_="DNS={2}&"' -f $CertificateTemplate, $NewLine, $SubjectAlternateName }

  6. Run the following commands to add any optional IP Address subject alternate names to the certificate template: 

    ForEach ($CertificateIPAddress in $CertificateIPAddresses) { $CertificateTemplate = '{0}{1}_continue_="IPAddress={2}&"' -f $CertificateTemplate, $NewLine, $CertificateIPAddress }

  7. Run the following commands to trim the certificate template: 

    $CertificateTemplate = $CertificateTemplate -replace '&"\s*$', '"'

  8. Run the following commands to write the certificate template file:

    $Content | Out-File -FilePath $CertificateTemplateFile -Force

  9. Run the following commands to review the certificate template file: 

    Get-Content -Path $CertificateTemplateFile

  10. Run the following commands to create the certificate request file:

    certreq -new -f $CertificateTemplateFile $CertificateRequestFile

  11. Run the following commands to review the certificate request file: 

    Get-Content -Path $CertificateRequestFile

  12. Run the following commands to retrieve the certificate request file name: 

    Get-Item -Path $CertificateRequestFile

Submit the certificate request to a certificate authority

References