taylan bilgisayar

PowerShell Script To Submit Certificate Requests In Bulk Using Certreq.exe

How to Use PowerShell and Certreq.exe to Submit Certificate Requests in Bulk

If you need to request multiple certificates from an Enterprise CA using certreq.exe, you can use PowerShell to automate the process and save time. In this article, we will show you how to create a PowerShell script that can submit certificate requests in bulk using certreq.exe and a template file.

What is Certreq.exe

Certreq.exe is a command-line tool that allows you to create, submit, and retrieve certificate requests from a certification authority (CA). You can use certreq.exe to request certificates for various purposes, such as web servers, client authentication, or code signing. Certreq.exe can also be used to install and export certificates and certificate chains.

What is PowerShell

PowerShell is a scripting language and a command-line shell that allows you to automate tasks and manage systems. PowerShell can interact with various Windows components, such as Active Directory, Registry, WMI, COM, .NET, and more. PowerShell can also run external commands and tools, such as certreq.exe.

How to Use PowerShell and Certreq.exe to Submit Certificate Requests in Bulk

To use PowerShell and certreq.exe to submit certificate requests in bulk, you need to follow these steps:

Create a template file that contains the information for the certificate request, such as subject name, key length, extensions, attributes, etc. You can use any text editor to create the template file, but make sure it has the .inf extension. For example, you can create a file called policy.inf with the following content:

[Version]

Signature=\"$Windows NT$\"

[NewRequest]

Subject = \"CN=www.example.com\"

Exportable = TRUE

KeyLength = 2048

KeySpec = 1

KeyUsage = 0xA0

MachineKeySet = TRUE

ProviderName = \"Microsoft RSA SChannel Cryptographic Provider\"

ProviderType = 12

SMIME = FALSE

RequestType = CMC

[Strings]

szOID_SUBJECT_ALT_NAME2 = \"2.5.29.17\"

szOID_ENHANCED_KEY_USAGE = \"2.5.29.37\"

szOID_PKIX_KP_SERVER_AUTH = \"1.3.6.1.5.5.7.3.1\"

szOID_PKIX_KP_CLIENT_AUTH = \"1.3.6.1.5.5.7.3.2\"

[Extensions]

%szOID_SUBJECT_ALT_NAME2% = \"{text}dns=www.example.com&dns=example.com\"

%szOID_ENHANCED_KEY_USAGE% = \"{text}%szOID_PKIX_KP_SERVER_AUTH%,%szOID_PKIX_KP_CLIENT_AUTH%\"

[RequestAttributes]

CertificateTemplate=WebServer

This template file will request a web server certificate with the subject name www.example.com and two subject alternative names (SANs): www.example.com and example.com.

Create a folder that contains the template file and the certificate request files (.csr) that you want to submit. For example, you can create a folder called C:\\Certs\\Requests\\ and copy the policy.inf file and the .csr files there.

Create a PowerShell script that can loop through the .csr files in the folder and submit them using certreq.exe with the template file as a parameter. For example, you can create a file called Request-Certificates.ps1 with the following content:

# Specify the location of the request files

$csrdir = \"C:\\Certs\\Requests\\\"

# Get the list of .csr files in the folder

$files = Get-ChildItem $csrdir

$csrs = $files Where-Object {$_.extension -eq \".csr\"}

# Specify the parameters for certreq.exe

$template = \"WebServer\" # must always use concatenated name format

$CA = \"MyCAServer.mydomain.com\\MyCAName\"

# Loop through each .csr file and submit it using certreq.exe

foreach ($csr in $csrs)

{

Write-Host \"Requesting certificate $csr ...\"

$basename = $csr.basename

# Build the command line ec8f644aee