How to create a Self-Signed SAN Certificate in Windows 8

  • Article

One of the cool features of Windows 8 is the improved set of PowerShell commandlets that have been shipped with it. There are several of them which could have made the task a lot easier for the server admins.

In here I will be discussing about one of the commandlets using which we can create a self-signed SSL Certificate. Yes, I mean self-signed and a SAN Certificate.

What you also need to know is that there are no lengthy procedures, it is a simple command with few parameters which adds to the simplicity.

So here are few pre-requisites that I could think of,

  • Windows PowerShell and PowerShell ISE needs to be installed.
  • OS is either Windows Server 2012 or Windows 8. (I’m not aware if this cmdlet has been back-ported to previous OS versions, I hope they do)
  • The Windows PowerShell help menu is updated (Well this is not a necessity, but it will help if this is done.)

Commandlet Name: New-SelfSignedCertificate

Syntax:

New-SelfSignedCertificate [-CertStoreLocation <String>] [-CloneCert <Certificate>] [-DnsName <String>] [-Confirm <SwitchParameter>] [-WhatIf <SwitchParameter>] [<CommonParameters>]

Scenario

Consider you need to create a self-signed SAN certificate for the following hostnames:

Using the above commandlet the cert can be issued and automatically placed in the personal store of My Computer Account.

Here is the command that we need to execute to generate the cert.

PS C:\> New-SelfSignedCertificate -DnsName www.test.com, www.test.edu, www.test.testing.com -CertStoreLocation cert:\LocalMachine\My

Directory: Microsoft.PowerShell.Security\Certificate::LocalMachine\My

 

Thumbprint Subject

---------- -------

7020CC054B5818262ECF6C7D9BB2E2546D2B4FD8 CN=www.test.com

This will install the self-signed cert in the Personal store of machine account.

Note: Certificate wouldn’t be trusted. Place the certificate in the Trusted Root CA store and the error will go away.

So this is what the certificate looks like:

image image

It can’t get easier than this.

Another thing worthwhile mentioning is the help menu, which is very descriptive. I have pasted the entire help menu content for the above commandlet below

The good thing is that it also provides descriptive examples.

New-SelfSignedCertificate Help

Description

        The New-SelfSignedCertificate cmdlet creates a self-signed certificate for testing purposes. Using the CloneCert parameter, a test certificate can be created based on an existing certificate with all settings copied from the original certificate except for the public key. A new key of the same algorithm and length will be created.

        If an existing certificate is not being cloned, then an SSL server certificate with the following default settings is created:

  • Subject: Empty
  • Key: RSA 2048
  • EKUs: Client Authentication and Server Authentication
  • Key Usage: Digital Signature, Key Encipherment (a0)
  • Validity Period: One year

Delegation may be required when using this cmdlet with Windows PowerShell® remoting and changing user configuration.

Parameters

-CertStoreLocation <String>

        Specifies the certificate store in which a new certificate will be stored. The current path is the default value.

  • Required? False
  • Position? Named
  • Default value .
  • Accept pipeline input? False
  • Accept wildcard characters? False

-CloneCert <Certificate>

         Identifies the certificate to copy when creating a new certificate. The certificate being cloned can be identified by an X509 certificate or the file path in the certificate provider. When this parameter is used, all fields and extensions of the certificate will be inherited except the public key (a new key of the same algorithm and length will be created) and the NotAfter and NotBefore fields (the validity period for the NotBefore field is set to ten minutes in the past).
  • Required? False
  • Position? Named
  • Default value
  • Accept pipeline input? true (ByValue)
  • Accept wildcard characters? False

-DnsName <String>

        Specifies one or more DNS names to put into the Subject Alternative Name extension of the certificate when a certificate to be copied is not specified via the CloneCert parameter. The first DNS name is also saved as Subject Name and Issuer Name.

  • Required? False
  • Position? Named
  • Default value
  • Accept pipeline input? False
  • Accept wildcard characters? False

-Confirm <SwitchParameter>

        Prompts you for confirmation before running the cmdlet.

  • Required? False
  • Position? Named
  • Default value
  • Accept pipeline input? False
  • Accept wildcard characters? False

-WhatIf <SwitchParameter>

        Shows what would happen if the cmdlet runs. The cmdlet is not run.

  • Required? False
  • Position? Named
  • Default value
  • Accept pipeline input? False
  • Accept wildcard characters? False
Inputs

Microsoft.CertificateServices.Commands.Certificate

The Certificate object can either be provided as a Path object to a certificate or an X509Certificate2 object.

Outputs

System.Security.Cryptography.X509Certificates.X509Certificate2

An X509Certificate2 object for the certificate that has been created.