Completing a Certificate Request using PowerShell?

Before, blabbing on about tonight’s topic, I wanted to share something very special. My good friend Monil sent me a really funny picture of his little girl playing with my Windows PowerShell Unleashed book. Apparently, the book has become her new favorite play thing. So, I guess PowerShell has gotten so popular that it is now replacing the Baby Einstein videos. Talk about starting them early! [url=http://www.flickr.com/photos/10233132@N05/1200422380/][img]http://farm2.static.flickr.com/1376/1200422380_fb80360f49_m.jpg[/img][/url] ***Disclaimer, actually she likes the book because it is red*** Moving on… Tonight, I wanted to post a little quick and dirty script that I whipped up to complete a certificate request using PowerShell and certreq.exe. The details for what the script does are as follows:

1. It takes in a user’s UID and email address using the read-host cmdlet (ideally an enrollment agent would be running this script).
2. Using that information the script then generates an INF file that can be used by certreq.exe.
3. Next, using that INF file the script then uses certreq.exe to generate and complete a certificate request to an online issuing CA that is hosting a particular certificate template.

Note: that the certificate template and the issuing CA used are defined as variables in the beginning of the script. What is cool about this script (besides automating a certificate request) is that it clearly shows how PowerShell can be used with existing command line tools to complete various automation tasks. In this example, instead of an enrollment agent generating a certificate request via a manual process which includes using notepad and certreq.exe, that agent can now just kick off a script. Once the script has finished running, they then just need to generate and send out a PFX file (which could also be automated). Anyhow, here is the script let me know if you have any questions:

[string]$TemplateName = "ABCUserAuthentication"
[string]$CAName = "pkica01.abc.comABC INC Class 2 Low Assurance CA 01"
[string]$UID = read-host "Please enter the UID"
[string]$Email = read-host "Please enter the user's Email Address"

###################################
# Generate Request File
###################################
write-host
write-host "Generating Request File" -ForegroundColor Yellow

remove-item .supusercert.inf -ErrorAction silentlycontinue
remove-item .supusercert.req -ErrorAction silentlycontinue

add-content .supusercert.inf "[NewRequest]`r
Subject = `"CN=$UID`"`r
Exportable = TRUE`r 
RequestType = CMC`r
[RequestAttributes]`r
CertificateTemplate = `"$TemplateName`"`r
SAN = `"Email=$Email`""

.certreq -new .usercert.inf .usercert.req

###################################
# Send Request
###################################
write-host "Sending Certificate Request" -ForegroundColor Yellow

.certreq -submit -config "$CAName" .supusercert.req .$UID.cer

###################################
# Install Certificate
###################################
write-host "Installing Certificate" -ForegroundColor Yellow

.certreq -accept .$UID.cer


For all of today's Microsoft news, visit the Microsoft Subnet.