Creating Self Signed SSL Certificate in PowerShell

Administrators can use self-signed certificates for testing/developing tasks or to provide certificates for internal Intranet services (IIS, Exchange, Web Application Proxy, Azure Application Gateway) if they cannot deploy PKI/CA infrastructure or purchase a trusted certificate from a Certification Authority.

Following command may be used to create a new SSL certificate (with the default SSLServerAuthentication type) for the DNS name test.contoso.com (use an FQDN name) and placing it to the personal certificates on a computer.

New-SelfSignedCertificate -DnsName test.contoso.com -CertStoreLocation cert:\LocalMachine\My

By default, a self-signed certificate is generated with the following settings:

• Cryptographic algorithm: RSA;
• Key length: 2048 bit;
• Acceptable key usage: Client Authentication and Server Authentication;
• The certificate can be used for: Digital Signature, Key Encipherment;
• Certificate validity period: 1 year;
• Crypto provider: Microsoft Software Key Storage Provider.

Above command creates a new certificate and imports it into the computer’s personal certificate store. Open the certlm.msc MMC snap-in and make sure that a new certificate appears in the Personal section of the computer’s certificate store.

Using the Get-ChildItem cmdlet, you can display all the parameters of the created certificate by its Thumbprint:

Get-ChildItem -Path "Cert:\LocalMachine\My" | Where-Object Thumbprint -eq 2175A76B10F843676951965F52A718F635FFA043 | Select-Object *