PowerShell Self Signed Certificate

2023-06-09

301
0
PowerShell
2023-09-05

Azure VPN Gateway 每年要更新憑證

根憑證

生成根憑證

$cert = New-SelfSignedCertificate -Type Custom -KeySpec Signature `
-Subject "CN=P2SRootCert22" -KeyExportPolicy Exportable `
-HashAlgorithm sha256 -KeyLength 2048 `
-CertStoreLocation "Cert:\CurrentUser\My" -KeyUsageProperty Sign -KeyUsage CertSign -FriendlyName "P2S Root Cert 2022"

更新根憑證

查詢舊憑證

Get-ChildItem -Path "Cert:\CurrentUser\My"

Thumbprint	Subject
3AB2CE7FBDE37A37BCD73ABE4F34C6FF8A8AD8AC	P2SRootCert21
9159C8F9FEACA4FF14E497B3BE773892105525E4	P2SRootCert22

複製出一個新憑證 (預設期限一年)

$cert = Get-ChildItem -Path "Cert:\CurrentUser\My\9159C8F9FEACA4FF14E497B3BE773892105525E4"
New-SelfSignedCertificate -CloneCert $cert

Thumbprint	Subject
3AB2CE7FBDE37A37BCD73ABE4F34C6FF8A8AD8AC	P2SRootCert21
9159C8F9FEACA4FF14E497B3BE773892105525E4	P2SRootCert22
3E3322B7D988A012BA054E849797A0FA31B4B7AE	P2SRootCert23

複製時也可以改內容

New-SelfSignedCertificate -CloneCert $cert -Subject "CN=P2SRootCert23" -FriendlyName "P2S Root Cert 2023"

P.S. 9159C8F9FEACA4FF14E497B3BE773892105525E4 要改成你要改的憑證指紋

用戶端憑證

使用既有根憑證產生對應用戶端憑證 (子憑證)

New-SelfSignedCertificate -Type Custom -DnsName P2SChildCert23 -KeySpec Signature `
-Subject "CN=P2SChildCert" -KeyExportPolicy Exportable `
-HashAlgorithm sha256 -KeyLength 2048 `
-CertStoreLocation "Cert:\CurrentUser\My" `
-Signer $cert -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2")  -FriendlyName "P2S Child Cert 2023"

Thumbprint	Subject	EnhancedKeyUsageList
3AB2CE7FBDE37A37BCD73ABE4F34C6FF8A8AD8AC	CN=P2SRootCert21
9159C8F9FEACA4FF14E497B3BE773892105525E4	CN=P2SRootCert22
3E3322B7D988A012BA054E849797A0FA31B4B7AE	CN=P2SRootCert23
2CE7FBDE37A37BCD73A2BA054E849797A0FA31B	CN=P2SChildCert	用戶端驗證