Request to certificate with powershell?

Question

Request to certificate with powershell?

Андрей Михалевский 3,476

Hi. I have AD CS. Is it possible to request a template certificate using Powershell from https://domain.com/certsrv/certrqma.asp ?

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Rich Matheisen 48,121

It's been a very long time since I've used *nix!

Here's something cobbled together from bits and pieces found elsewhere:

# create a CSR
openssl req -new -newkey rsa:2048 -nodes -keyout mykey.key -out mycsr.csr

# submit the CSR to the Microsoft CA
curl -k -X POST -H "Content-Type: application/x-www-form-urlencoded" \
-d "Mode=newreq&CertRequest=$(cat mycsr.csr)&CertAttrib=CertificateTemplate:WebServer&TargetStoreFlags=0&SaveCert=yes&ThumbPrint=" \
https://your-ca-server/certsrv/certfnsh.asp

# get the certificate
curl -k -X GET "https://your-ca-server/certsrv/certnew.cer?ReqID=<RequestID>&Enc=b64" -o mycert.cer

# Install the cert
openssl x509 -in mycert.cer -out mycert.pem -outform PEM

I'm not at all sure about ASP support anymore.

Be VERY sure about the security of the URL!!!! The very last thing you want is to expose that URL to unauthorized users. Issuing certs that are valid in your organization to individuals (or machines) over which you have no control would be disastrous.

You may find better information in a forum for your version of Linux. You should probably be using the "Windows Server Security" (not Windows Server Powershell) in any further questions in Microsofts' Q&A forums.

Gavin 1 Reputation point

2026-10-08T23:06:23.05+00:00
Found this and it was perfect for me!

One single cmdlet that generates the CSR, sends to the CA for signing and installs the certificate on the machine.

https://gist.github.com/ehrnst/fccc14760a4bf7597979377deef29f82

Get-Certificate ` -Template "WebServer" ` -DnsName "computername.fqdn" ` -CertStoreLocation cert:\LocalMachine\My ` -SubjectName "CN=computerName.fqdn, C=GB, L=LONDON, O=Organization OU=Department, S=England"

2 additional answers

Gavin 1 Reputation point

2026-10-08T23:06:23.05+00:00

Found this and it was perfect for me!

One single cmdlet that generates the CSR, sends to the CA for signing and installs the certificate on the machine.

https://gist.github.com/ehrnst/fccc14760a4bf7597979377deef29f82

Get-Certificate ` -Template "WebServer" ` -DnsName "computername.fqdn" ` -CertStoreLocation cert:\LocalMachine\My ` -SubjectName "CN=computerName.fqdn, C=GB, L=LONDON, O=Organization OU=Department, S=England"

Answer 1

Hari devaraj 0

Export-Certificate -Cert $Certificate -FilePath "C:$certname.cer" $Certificate=Get-ChildItem –Path <Certificate path> Export-Certificate -Cert $Certificate -FilePath "C:\Users\admin\Desktop$certname.cer" Get-ChildItem -Path cert:\CurrentUser\my | Export-Certificate -FilePath c:\certs\allcerts.sst $Pwd = ConvertTo-SecureString -String "Testing" -Force -AsPlainText

Export-PfxCertificate -Cert $Certificate -FilePath "D:$certname.pfx" -Password $Pwd

Hari devaraj 0 Reputation points

2025-09-07T07:30:09.2466667+00:00

create a CSR

openssl req -new -newkey rsa:2048 -nodes -keyout mykey.key -out mycsr.csr

submit the CSR to the Microsoft CA

curl -k -X POST -H "Content-Type: application/x-www-form-urlencoded" \

-d "Mode=newreq&CertRequest=$(cat mycsr.csr)&CertAttrib=CertificateTemplate:WebServer&TargetStoreFlags=0&SaveCert=yes&ThumbPrint=" \

https://your-ca-server/certsrv/certfnsh.asp

get the certificate

curl -k -X GET "https://your-ca-server/certsrv/certnew.cer?ReqID=<RequestID>&Enc=b64" -o mycert.cer

Install the cert

openssl x509 -in mycert.cer -out mycert.pem -outform PEM

Answer 2

Rich Matheisen 48,121

Use the Get-Certificate cmdlet.

You might be able to use the Request-Certificate script, too: (https://www.powershellgallery.com/packages/Request-Certificate/1.5.0)

Андрей Михалевский 3,476 Reputation points

2024-08-28T07:15:18.2366667+00:00

Thank you. Can this be done without AD CS commandlets ? For example with Web request, because I want to issue certificates from Linux users as well.
Rich Matheisen 48,121 Reputation points

2024-08-28T19:04:45.13+00:00

I believe you'd have to use open-SSL to create a CSR, transfer the CSR to the CA and then use the CSR to issue the cert. Then transfer the cert back to the Linux machine and install the cert wherever you've chosen to place them.
Андрей Михалевский 3,476 Reputation points

2024-08-28T23:02:47.3+00:00

Thank you, but can you give me more details on how I can do this with powershell web request and then rewrite it to curl ? What address should I go to and what does the request look like.