Automate certificate revocation on a Microsoft PKI

Create a certificate from a request file with Powershell

The purpose of this post is to show you the different available Powershell cmdlets to get a certificate from a Microsoft PKI using a base64 certificate request file. The following command lines will uses the Powershell module PSPKI. To install it, run the following command :

This module is intended to simplify various PKI and Active Directory Certificate Services management tasks by using automation with Windows PowerShell.

This module is intended for Certification Authority management. For local certificate store management you should consider to use Quest AD PKI cmdlets.

You can use openssl to generate a csr. This procedure describes how to create the csr file.

In our exemple the csr file name will be : request.csr

Now you will need to get your local PKI server information. It is possible your infrastructure hosts multiple issuing CA server. To get the current list, execute the following command:

We will use for our example the IssuingCA02 (fqdn=caserver02.domain.local).

The following line will submit the csr request file to our CA server called IssuingCA02. We will use the template Webserver to issue the certificate:

We can now save the issued certificate by using these lines (destination certificate filename : C:\Temp\mycert.cer):

<>

My Powershell script categories

Sample of the cmdlets availables in the PSPKI module (full list here):
Add-AdCertificate
Add-AdCertificateRevocationList
Add-AuthorityInformationAccess (Alias: Add-AIA)
Add-CAAccessControlEntry (Alias: Add-CAACL)
Add-CATemplate
Add-CertificateEnrollmentPolicyService
Add-CertificateEnrollmentService
Add-CertificateTemplateAcl
Add-CRLDistributionPoint (Alias: Add-CDP)
Convert-PemToPfx
Convert-PfxToPem
Deny-CertificateRequest
Disable-PolicyModuleFlag
Get-CATemplate
Get-CertificateRequest
Get-CertificateRevocationList (Alias: Get-CRL)
Get-CertificateRevocationListFlag (Alias: Get-CRLFlag)
Get-CertificateTemplate
Get-CertificateTemplateAcl
Get-IssuedRequest
Get-PendingRequest
Publish-CRL
Remove-CATemplate
Remove-ExtensionList
Restart-CertificationAuthority
Revoke-Certificate
Start-CertificationAuthority
Test-WebServerSSL
Uninstall-CertificationAuthority

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Social Media Auto Publish Powered By : XYZScripts.com
%d bloggers like this: