certreq command

This article will demonstrate how to use the certreq command in Windows to perform various SSL certificate related functions.

certreq submit CSR

To submit a Certificate Signing Request (CSR) with certreq run the following command.

certreq -submit -config "<server>\<ca_name>" csr.csr cert.cer

• -submit – Submit the CSR to the Microsoft CA
• -config “<server>\<ca_name>” – Specifies the CA and its host
• csr.csr – The CSR file you are submitting
• cert.cer – The certificate that will be generated

certreq submit CSR with template

Alternatively, you can use certreq to submit a CSR with a prescribed template. This example will use a webserver template. Run this command to submit a CSR to a CA with a webserver template.

certreq -q -adminforcemachine -submit -config '<server>\<ca_name' -attrib "CertificateTemplate:PrivateWebServer" "csr.pem" "cert.pem"

• -q – Quiet mode. This will suppress confirmations and is used for script automation
• -adminforcemachine – Submit the request as a machine or computer instead of as a user. This is used when the machine has permission to request the certificate but the user may not.
• -submit – Submit the CSR to the Microsoft CA
• -config “<server>\<ca_name>” – Specifies the CA and its host
• -attrib “CertificateTemplate:PrivateWebServer” – Specify the certificate template the certificate should be issued for.
• csr.csr – The CSR file you are submitting
• cert.cer – The certificate that will be generated

certreq generate CSR

To generate a CSR with certreq you will first need to create an INF file. Alternatively the contents of the INF file may be a string inside of a PowerShell script.

[Version]
Signature= "$Windows NT$" 
[NewRequest]
Subject = "CN=$hostname"
KeySpec = 1
KeyLength = 2048
Exportable = TRUE
MachineKeySet = TRUE
SMIME = False
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0
[Extensions]
2.5.29.17 = "{text}"
_continue_ = "dns=$hostname&"

[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1 

Run this command specifying the new inf file.

certreq -new request.inf csr.csr

• -new request.inf – The inf file being used to create the CSR
• csr.csr – The name of the file the CSR will be created to

Verify the CSR with certreq

To verify the CSR with certreq run this command.

certreq -dump csr.csr

Alternatively you can verify the CSR with OpenSSL.

Conclusion

This article has demonstrated how to use the certreq command to perform various SSL certificate functions including generating a CSR with an INF file, submit the CSR to a CA, and submitting the CSR to a CA with a specific template. Read this article for more information on automating this process. Let us know in the comments if you have any questions or would like to see more examples on how to use the certreq command.