Create the Austin certificate via PowerShell

Note: this process must be run on the primary EID Feed server in each domain.

1. Log into a server joined to the Austin Active Directory as a user with permissions to request a certificate from the desired template

2. Open an administrative PowerShell prompt

3. In the same administrative PowerShell prompt, navigate to the location where the certificate request should be created: 

   #example Set-Location C:\Working

4. In the same administrative PowerShell prompt, run the following command to set the subject of the certificate:  

   $cert_url = <FQDN for the certificate> $cert_template = <short name of the certificate template>

5. In the same administrative PowerShell prompt, run the following to create the INF file then open the INF file to review the output:

   
   

   $cert_inf = ((Get-Location).Path + "\" + $cert_url + ".inf") $cert_req = ((Get-Location).Path + "\" + $cert_url + ".req") $cert_cer = ((Get-Location).Path + "\" + $cert_url + ".cer") $cert_txt = @" [Version] Signature=`"`$Windows NT`$`" [NewRequest] Subject=`"CN=$cert_url`" Exportable=TRUE MachineKeySet=TRUE KeyLength=2048 KeySpec=1 [RequestAttributes] CertificateTemplate=$cert_template "@ New-Item $cert_inf -Type File -Force Set-Content $cert_inf $cert_txt notepad $cert_inf

6. In the same administrative PowerShell prompt, run the following to create the request, submit the request to a certificate authority, then accept the response:

   certreq -new $cert_inf $cert_req certreq -submit $cert_req $cert_cer certreq -accept $cert_cer

7. In the same administrative PowerShell prompt, run the following to create the request, submit the request to a certificate authority, then accept the response: 

   $cert_pw = Read-Host -Prompt "Enter password" -AsSecureString

8. In the same administrative PowerShell prompt, run the following to create the request, submit the request to a certificate authority, then accept the response: 

   $cert_obj = Get-ChildItem -Path "cert:\LocalMachine\My" | Where-Object {$_.Subject -match "eidfeed-"} | Sort-Object NotBefore -Descending | Select-Object -First 1 $cert_rca = Get-ChildItem -Path "cert:\LocalMachine\Root" | Where-Object {$_.Subject -match $cert_obj.Issuer} | Sort-Object NotBefore -Descending | Select-Object -First 1 $cert_obj | Export-PfxCertificate -FilePath $cert_pfx -Password $cert_pw $cert_rca | Export-Certificate -FilePath $cert_crt

Export the Austin certificate via PowerShell

1. Log into a server joined to the Austin Active Directory as a user with permissions to request a certificate from the desired template

2. Open an administrative PowerShell prompt

3. In the same administrative PowerShell prompt, run the following command to set the subject of the certificate:  

   $cert_url = <FQDN for the certificate>

4. In the same administrative PowerShell prompt, run the following command to set the password for the exported PFX file:

   $cert_pw = Read-Host -Prompt "Enter password" -AsSecureString

5. In the same administrative PowerShell prompt, run the following to identify the certificate then export the PFX and CRT files: 

   $cert_pfx = ((Get-Location).Path + "\" + $cert_url + ".pfx") $cert_crt = ((Get-Location).Path + "\" + $cert_url + ".crt") $cert_obj = Get-ChildItem -Path "cert:\LocalMachine\My" | Where-Object {$_.Subject -match $cert_url} | Sort-Object NotBefore -Descending | Select-Object -First 1 $cert_rca = Get-ChildItem -Path "cert:\LocalMachine\Root" | Where-Object {$_.Subject -match $cert_obj.Issuer} | Sort-Object NotBefore -Descending | Select-Object -First 1 $cert_obj | Export-PfxCertificate -FilePath $cert_pfx -Password $cert_pw $cert_rca | Export-Certificate -FilePath $cert_crt