Powershell之New-SelfSignedCertificate命令创建自签名证书

痛定思痛。 2022-10-14 15:45 240阅读 0赞

## 什么是New-SelfSignedCertificate ##

`The New-SelfSignedCertificate cmdlet creates a self-signed certificate for testing purposes.`  
其实`New-SelfSignedCertificate`就是powershell自带的命令，用来创建一个自签证的证书，作为测试用途。有时候局域网做一些https等等之类的需要安全证书，就可以生成了。

`输入类型`是可以传送到 cmdlet 的对象的类型—— Microsoft.CertificateServices.Commands.Certificate : The Certificate object can either be provided as a Path object to a certificate or an X509Certificate2 object.

`输出类型`是 cmdlet 发出的对象的类型——  
System.Security.Cryptography.X509Certificates.X509Certificate2，An X509Certificate2 object for the certificate that has been created.

## 运行命令 ##

New-SelfSignedCertificate -DnsName "www.moshow.dev.com", "www.zhengkai.csdn.com" -CertStoreLocation "cert:\LocalMachine\My"

`cert:\LocalMachine\My`其实就对应了MMC里面的`证书-个人`

## ![在这里插入图片描述][20210522103626712.png]   更多参数请看官方文档 ##

可用参数还是相当多，但是每个参数官方都有对应的解释。

New-SelfSignedCertificate [-AlternateSignatureAlgorithm] [-CertStoreLocation <String> ] [-CloneCert <Certificate> ] [-Container <System.String> ] [-CurveExport <Microsoft.CertificateServices.Commands.CurveParametersExportType> { None | CurveParameters | CurveName} ] [-DnsName <String[]> ] [-ExistingKey] [-Extension <System.Security.Cryptography.X509Certificates.X509Extension[]> ] [-FriendlyName <System.String> ] [-HardwareKeyUsage <Microsoft.CertificateServices.Commands.HardwareKeyUsage[]> ] [-HashAlgorithm <System.String> ] [-KeyAlgorithm <System.String> ] [-KeyDescription <System.String> ] [-KeyExportPolicy <Microsoft.CertificateServices.Commands.KeyExportPolicy[]> ] [-KeyFriendlyName <System.String> ] [-KeyLength <System.Int32> ] [-KeyLocation <System.String> ] [-KeyProtection <Microsoft.CertificateServices.Commands.KeyProtection[]> ] [-KeySpec <Microsoft.CertificateServices.Commands.KeySpec> { None | KeyExchange | Signature} ] [-KeyUsage <Microsoft.CertificateServices.Commands.KeyUsage[]> ] [-KeyUsageProperty <Microsoft.CertificateServices.Commands.KeyUsageProperty[]> ] [-NotAfter <System.DateTime> ] [-NotBefore <System.DateTime> ] [-Pin <System.Security.SecureString> ] [-Provider <System.String> ] [-Reader <System.String> ] [-SecurityDescriptor <System.Security.AccessControl.FileSecurity> ] [-SerialNumber <System.String> ] [-Signer <Microsoft.CertificateServices.Commands.Certificate> ] [-SignerPin <System.Security.SecureString> ] [-SignerReader <System.String> ] [-SmimeCapabilities] [-Subject <System.String> ] [-SuppressOid <System.String[]> ] [-TestRoot] [-TextExtension <System.String[]> ] [-Type <Microsoft.CertificateServices.Commands.CertificateType> { Custom | CodeSigningCert | DocumentEncryptionCert | SSLServerAuthentication | DocumentEncryptionCertLegacyCsp} ] [-Confirm] [-WhatIf] [ <CommonParameters>]

官方文档地址为：  
https://docs.microsoft.com/zh-cn/previous-versions/windows/powershell-scripting/hh848633(v=wps.640)

看不懂也没关系，直接看EXAMPLE就简单明了。

通常需要设置的参数：

*  DnsName
 *  Subject

## MMC查看已生成证书 ##

不知道MMC是什么？直接打开windows菜单或者`win+r`输入`mmc`。  
![在这里插入图片描述][20210522103925164.png]  
添加管理单元，如果英文版好像是add Snap-In之类。  
![在这里插入图片描述][20210522103959783.png]  
把证书添加过去  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L21vc2hvd2dhbWU_size_16_color_FFFFFF_t_70]  
点击`个人 - 证书` 就可以看到刚才生成的证书了。有什么不对或者需要添加，重新生成即可。

## ![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L21vc2hvd2dhbWU_size_16_color_FFFFFF_t_70 1]   TroubleShooting ##

如果遇到`New-SelfSignedCertificate : CertEnroll::CX509Enrollment::_CreateRequest: 拒绝访问。 0x80090010 (-2146893808 NTE_PERM)` 那么大概率是因为没有管理员权限，一定要右键以管理员权限运行Powershell ISE  
![在这里插入图片描述][20210522103513587.png]

[20210522103626712.png]: /images/20221014/c87611d1d378447e9c5914273002ab23.png
[20210522103925164.png]: /images/20221014/0b7d6095e2e04823b2449e893ee43a22.png
[20210522103959783.png]: /images/20221014/ef068f1da3ac4f0695fd975878b011a6.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L21vc2hvd2dhbWU_size_16_color_FFFFFF_t_70]: /images/20221014/c31f3d595b7a47b3978f6ce6f3314f5b.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L21vc2hvd2dhbWU_size_16_color_FFFFFF_t_70 1]: /images/20221014/9206b510ecae489db9429a5e3eae34a7.png
[20210522103513587.png]: /images/20221014/651104868b1b490e85b5b9ae4d7a3afe.png