PowerShell – script to generate a self-signed Certificate – exploring New-SelfSignedCertificate CMDLET

Hi All,

Greetings !

Today new PowerShell script – one more script in our bucket

Background

• We are continuing series on Microsoft Graph PowerShell
• To execute Microsoft Graph PowerShell – we need to connect first to Microsoft Graph
• There are various options available to connect Microsoft Graph using Connect-MgGraph CMDLET
• One of the approach we are exploring is – connect Microsoft Graph using App ID (client id) and X.509 Certificate (self signed certificate)

Connect-MgGraph -ClientId "YOUR_APP_ID" -TenantId "YOUR_TENANT_ID" -CertificateThumbprint "YOUR_CERT_THUMBPRINT"

OR

Connect-MgGraph -ClientId "YOUR_APP_ID" -TenantId "YOUR_TENANT_ID" -CertificateName "YOUR_CERT_SUBJECT"

OR

$Cert = Get-ChildItem Cert:\currentuser\$CertThumbprint
Connect-MgGraph -ClientId "YOUR_APP_ID" -TenantId "YOUR_TENANT_ID" -Certificate $Cert

• So to use we need certificate uploaded to our App

In this article I’ll be discussing – How to create self-signed (X.509) Certificate using PowerShell script

Steps to create a self-signed Certificate using PowerShell

• We will use the New-SelfSignedCertificate cmdlet to create a self-signed certificate

Example 1 – with simple one DNS name and certificate store location

$params = @{
    DnsName = 'knowledgejunction1.sharepoint.com'
    CertStoreLocation = 'Cert:\currentuser\My'
}
New-SelfSignedCertificate @params

Output:

PSParentPath: Microsoft.PowerShell.Security\Certificate::CurrentUser\My

Thumbprint                                Subject                                                                                           
----------                                -------                                                                                           
D503552E2636588DC6AF951454ADF9C823CAC77E  CN=knowledgejunction1.sharepoint.com     

• We have created this certificate in current user certificate store
• We could verify our certificate from current user certificate store
• Open certificate MMC console – run “certmgr.msc“

Example 2 – create the copy of certificate using CloneCert parameter

$OldCert = (Get-ChildItem -Path D503552E2636588DC6AF951454ADF9C823CAC77E)
$OldCert
New-SelfSignedCertificate -CloneCert $OldCert

Output:

PSParentPath: Microsoft.PowerShell.Security\Certificate::CurrentUser\My

Thumbprint                                Subject                                                                                           
----------                                -------                                                                                           
D503552E2636588DC6AF951454ADF9C823CAC77E  CN=knowledgejunction1.sharepoint.com                                                              
74C4E6E98FC9F7E2CE4B4EB365199EFA9F296456  CN=knowledgejunction1.sharepoint.com

• Here, we are fetching old certificate using Get-ChildItem with parameter –Path and value as Thumbprint of old certificate

Example 3 – create the certificate which expires in 6 month – NoAfter parameter

#Example 3 - create the copy of certificate using CloneCert parameter and expires in 6 months
$OldCert = (Get-ChildItem -Path D503552E2636588DC6AF951454ADF9C823CAC77E)
$OldCert
New-SelfSignedCertificate -CloneCert $OldCert -NotAfter (Get-Date).AddMonths(6)

Output:

PSParentPath: Microsoft.PowerShell.Security\Certificate::CurrentUser\My

Thumbprint                                Subject                                                                                           
----------                                -------                                                                                           
D503552E2636588DC6AF951454ADF9C823CAC77E  CN=knowledgejunction1.sharepoint.com                                                              
F97EF453D78E31BA3C6151BD066D92B7FCBD377B  CN=knowledgejunction1.sharepoint.com                                                              

We could check the expiry date by using Get-ChildItem as

Get-ChildItem -Path B6C506766A3F3606AAD9E33EDE041C3A62797411 | fl

Output:

Subject      : CN=knowledgejunction1.sharepoint.com
Issuer       : CN=knowledgejunction1.sharepoint.com
Thumbprint   : B6C506766A3F3606AAD9E33EDE041C3A62797411
FriendlyName : 
NotBefore    : 1/20/2024 5:03:18 PM
NotAfter     : 7/20/2024 5:13:18 PM
Extensions   : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, 
               System.Security.Cryptography.Oid}

Example 4 – create the certificate exploring Subject and Type parameter

#Example 4 - create the certificate exploring Subject and Type parameter
$params = @{
    Subject = 'knowledgejunction1.sharepoint.com'
    CertStoreLocation = 'Cert:\currentuser\My'
    Type='Custom'
}
New-SelfSignedCertificate @params

Output:

PSParentPath: Microsoft.PowerShell.Security\Certificate::CurrentUser\My

Thumbprint                                Subject                                                                                           
----------                                -------                                                                                           
02FA24832817EB1361AB35985A00257B209752BF  CN=knowledgejunction1.sharepoint.com 

Exploring few parameters

• CertStoreLocation –
  • Specifies the certificate store where new certificate will be stored
  • Possible values are
    • Cert:\LocalMachine\My – current machine certificate store
    • Cert:\CurrentUser\My – current user certificate store
• DnsName –
  • Specifies one or more DNS names.
  • First DNS name specified as – subject name
  • Second DNS name specified as – Issuer name
  • If only one DNS name is specified then it also saved as Issuer name – as we executed the CMDLET . Please check above snap
• CloneCert –
  • This parameter is used to copy the existing certificate
• NoAfter –
  • Specifies Date and Time as DateTime object – when the certificate expires
  • We could use Get-Date CMDLET as we used in our code snippet
  • Default value for this parameter is one year

Few Points

• By default certificate expires in one year once created
• By default certificate of type – “SSLServerAuthentication” is created
• Possible values for certificate type
  • Custom
  • CodeSigningCert
  • DocumentEncryptionCert
  • SSLServerAuthentication
  • DocumentEncryptionCertLegacyCsp

REFERENCES

• New-SelfSignedCertificate – https://learn.microsoft.com/en-us/powershell/module/pki/new-selfsignedcertificate?view=windowsserver2022-ps

Thanks for reading ! Stay tuned for more articles on Microsoft Graph PowerShell and PowerShell !

HAPPY LEARNING AHEAD 🙂 LIFE IS BEAUTIFUL 🙂