(AAD) Certificates - Request certificates from the Austin CAs - PowerShell

Create the Austin certificate via PowerShell

Note: this process must be run on the primary EID Feed server in each domain.

1. Log into a server joined to the Austin Active Directory as a user with permissions to request a certificate from the desired template

2. Open an administrative PowerShell prompt

3. In the same administrative PowerShell prompt, navigate to the location where the certificate request should be created: 

   #example
   Set-Location C:\Working

4. In the same administrative PowerShell prompt, run the following command to set the subject of the certificate:  

   $cert_url = <FQDN for the certificate>
   $cert_template = <short name of the certificate template>

5. In the same administrative PowerShell prompt, run the following to create the INF file then open the INF file to review the output:

   
   

   $cert_inf = ((Get-Location).Path + "\" + $cert_url  + ".inf")
   $cert_req = ((Get-Location).Path + "\" + $cert_url  + ".req")
   $cert_cer = ((Get-Location).Path + "\" + $cert_url  + ".cer")
   $cert_txt = @"
   [Version]
   Signature=`"`$Windows NT`$`"
   
   [NewRequest]
   Subject=`"CN=$cert_url`"
   Exportable=TRUE
   MachineKeySet=TRUE
   KeyLength=2048
   KeySpec=1
   
   [RequestAttributes]
   CertificateTemplate=$cert_template
   "@
   
   New-Item $cert_inf -Type File -Force
   Set-Content $cert_inf $cert_txt
   notepad $cert_inf

6. In the same administrative PowerShell prompt, run the following to create the request, submit the request to a certificate authority, then accept the response:

   certreq -new $cert_inf $cert_req
   certreq -submit $cert_req $cert_cer
   certreq -accept $cert_cer

7. In the same administrative PowerShell prompt, run the following to create the request, submit the request to a certificate authority, then accept the response: 

   $cert_pw = Read-Host -Prompt "Enter password" -AsSecureString

8. In the same administrative PowerShell prompt, run the following to create the request, submit the request to a certificate authority, then accept the response: 

   $cert_obj = Get-ChildItem -Path "cert:\LocalMachine\My" | Where-Object {$_.Subject -match "eidfeed-"} | Sort-Object NotBefore -Descending | Select-Object -First 1
   $cert_rca = Get-ChildItem -Path "cert:\LocalMachine\Root" | Where-Object {$_.Subject -match $cert_obj.Issuer} | Sort-Object NotBefore -Descending | Select-Object -First 1
   $cert_obj | Export-PfxCertificate -FilePath $cert_pfx -Password $cert_pw
   $cert_rca | Export-Certificate -FilePath $cert_crt

Export the Austin certificate via PowerShell

1. Log into a server joined to the Austin Active Directory as a user with permissions to request a certificate from the desired template

2. Open an administrative PowerShell prompt

3. In the same administrative PowerShell prompt, run the following command to set the subject of the certificate:  

   $cert_url = <FQDN for the certificate>

4. In the same administrative PowerShell prompt, run the following command to set the password for the exported PFX file:

   $cert_pw = Read-Host -Prompt "Enter password" -AsSecureString

5. In the same administrative PowerShell prompt, run the following to identify the certificate then export the PFX and CRT files: 

   $cert_pfx = ((Get-Location).Path + "\" + $cert_url  + ".pfx")
   $cert_crt = ((Get-Location).Path + "\" + $cert_url  + ".crt")
   $cert_obj = Get-ChildItem -Path "cert:\LocalMachine\My" | Where-Object {$_.Subject -match $cert_url} | Sort-Object NotBefore -Descending | Select-Object -First 1
   $cert_rca = Get-ChildItem -Path "cert:\LocalMachine\Root" | Where-Object {$_.Subject -match $cert_obj.Issuer} | Sort-Object NotBefore -Descending | Select-Object -First 1
   $cert_obj | Export-PfxCertificate -FilePath $cert_pfx -Password $cert_pw
   $cert_rca | Export-Certificate -FilePath $cert_crt