Artica Wiki

Create self signed certificates using PowerShell

On modern Windows versions (Windows 10/8.1 and Windows Server 2019/2016/2012R2) you can create a self-signed certificate using built-in PowerShell cmdlet New-SelfSignedCertificate without using additional tools.

To list all available cmdlets in the PKI module, run the command.

Get-Command -Module PKI

You should see this list

CommandType     Name                                               Version    Source
-----------     ----                                               -------    ------
Cmdlet          Add-CertificateEnrollmentPolicyServer              1.0.0.0    PKI
Cmdlet          Export-Certificate                                 1.0.0.0    PKI
Cmdlet          Export-PfxCertificate                              1.0.0.0    PKI
Cmdlet          Get-Certificate                                    1.0.0.0    PKI
Cmdlet          Get-CertificateAutoEnrollmentPolicy                1.0.0.0    PKI
Cmdlet          Get-CertificateEnrollmentPolicyServer              1.0.0.0    PKI
Cmdlet          Get-CertificateNotificationTask                    1.0.0.0    PKI
Cmdlet          Get-PfxData                                        1.0.0.0    PKI
Cmdlet          Import-Certificate                                 1.0.0.0    PKI
Cmdlet          Import-PfxCertificate                              1.0.0.0    PKI
Cmdlet          New-CertificateNotificationTask                    1.0.0.0    PKI
Cmdlet          New-SelfSignedCertificate                          1.0.0.0    PKI
Cmdlet          Remove-CertificateEnrollmentPolicyServer           1.0.0.0    PKI
Cmdlet          Remove-CertificateNotificationTask                 1.0.0.0    PKI
Cmdlet          Set-CertificateAutoEnrollmentPolicy                1.0.0.0    PKI
Cmdlet          Switch-Certificate                                 1.0.0.0    PKI
Cmdlet          Test-Certificate                                   1.0.0.0    PKI

To create a certificate, you have to specify the values of –DnsName (name of a server, the name may be arbitrary and different from localhost name) and -CertStoreLocation (a local certificate store in which the generated certificate will be placed). 

You can use the cmdlet to create a self-signed certificate on Windows 2019/2016/ 2012 R2 /2012.

To create a new SSL certificate (of the default SSLServerAuthentication type) for the DNS name artica.mydomain.tld (use a FQDN name) and place it to the list of personal certificates on a computer, run the following command:

New-SelfSignedCertificate -DnsName artica.mydomain.tld -CertStoreLocation cert:\LocalMachine\

PSParentPath: Microsoft.PowerShell.Security\Certificate::LocalMachine\

Thumbprint                                Subject
----------                                -------
02E22553ECAA436A42B4C7DCF7A788A37F28CA8B  CN=artica.mydomain.tld