Quickly generate, install, and export Self-Signed Certificate in PowerShell on Windows 8.1/2012R2
Self-Signed Certificate can be used widely in test, development, Local Web or Cloud Web Sites. This article will introduce a method to quickly generate Self-Signed Certificate, automatically export private key, and install the cert under LocalMachine\My and LocalMachine\Root on Win8.1 and Win2012.
I also wrap the main logic in Form UI, can generate dynamic script to execute, very easy to be used. [This is the complete script downloading link: CodePlex and GitHub]
As far as we know, we have several methods to create Self-Signed certificate. For example, using MakeCert and CertMgr，using SelfSSL or SelfSSL7，using IIS 7/8 management console，or use complicated PowerShell script. These methods require to remember multiple command lines switches, or manual UI operation，or deep understand on details of certificate generation. This method I introduce here is to use Powershell PKI Cmdlet coming from new system, we only need to tell basic Certificate Subject, Private Key Protect password, and Certificate Export Path：
GenerateSelfSignedCert www.mytest.com MyTestPassword c:\temp\mytest.pfx
The function GenerateSelfSignedCert definition is:
<#
.DESCRIPTION
SelfSignedCertificate AutoScript
.NOTES
Author: Freist Li
Last Updated: 10/30/2014
#>
#Cert Genearation Related Functions
#**************************************************************************************
#Create Cert, install Cert to My, install Cert to Root, Export Cert as pfx
Function GenerateSelfSignedCert{
Param (
$certcn,
$password,
$certfilepath
)
#Check if the certificate name was used before
$thumbprintA=(dir cert:\localmachine\My -recurse | where {$_.Subject -match "CN=" +
$certcn} | Select-Object -Last 1).thumbprint
if ($thumbprintA.Length -gt 0)
{
Write-Host "Duplicated Cert Name used" -ForegroundColor Cyan
return
}
else
{
$thumbprintA=New-SelfSignedCertificate -DnsName $certcn -CertStoreLocation cert:\LocalMachine\My
|ForEach-Object{ $_.Thumbprint}
}
#If generated successfully
if ($thumbprintA.Length -gt 0)
{
#query the new installed cerificate again
$thumbprintB=(dir cert:\localmachine\My -recurse | where {$_.Subject -match "CN=" + $certcn}
| Select-Object -Last 1).thumbprint
#If new cert installed sucessfully with the same thumbprint
if($thumbprintA -eq $thumbprintB )
{
$message = $certcn + " installed into LocalMachine\My successfully with thumprint "+$thumbprintA
Write-Host $message -ForegroundColor Cyan
$mypwd = ConvertTo-SecureString -String $password -Force –§CAsPlainText
Write-Host "Exporting Certificate as .pfx file" -ForegroundColor Cyan
Export-PfxCertificate -FilePath $certfilepath -Cert cert:\localmachine\My\$thumbprintA
-Password $mypwd
Write-Host "Importing Certificate to LocalMachine\Root" -ForegroundColor Cyan
Import-PfxCertificate -FilePath $certfilepath -Password $mypwd
-CertStoreLocation cert:\LocalMachine\Root
}
else
{
Write-Host "Thumbprint is not the same between new cert and installed cert." -ForegroundColor Cyan
}
}
else
{
$message = $certcn + " is not created"
Write-Host $message -ForegroundColor Cyan
}
}
After certificate is generated and installed，PowerShell will output：
In Certificate Manager Console, we can see
For the exported .pfx file，can be used with Local Web Service Or Microsoft Azure:
Bsaed on above GenerateSelfSignedCert function，I add more code to dynamic generate code to embed different parameters from Form UI. With this way, it can prompt friendly Form UI, generate your expected script, run it directly or copy it to target machine to execute. Because Certificate Installation on machine store needs admin permission, so you should open PowerShell or PowerShell_ISE with Admin Permission
The complete script downloading link: CodePlex and GitHub
Regards,
Freist Li from GBSD DSI Team