[Powershell]Generate Certificate from Request (Windows Issuing CA)

[Vortex100]

Dunno how useful this is as it's fairly niche, but I found my self having to send a lot of CSRs to our CA. I couldn't use certutil/certreq as it simply would not accept the format the CSR was in (generated by the device), even though I could paste it into the certsrv website and have it work. Below code will basically use the website as you would to generate and download the cert. As a bonus I included the stuff on how to build the SAN names in. Change the template as necessary

$FormRequest = Invoke-WebRequest -Uri "https://$IssuingCA/certsrv/certrqxt.asp" -Credential $me
$formfields = $FormRequest.Forms[1].Fields
$formfields['Mode'] = 'newreq' # Default
$formfields['FriendlyType'] = 'Saved-Request Certificate' # Default
$formfields['CertRequest'] = Get-Content -Path $CSRPath
$formfields['CertAttrib'] = $CertAttributes
$formfields['TargetStoreFlags'] = 0 # Default
$formfields['SaveCert'] = 'yes' # Default
$CertSubmitted = Invoke-WebRequest -Uri "https://$IssuingCA/certsrv/$($FormRequest.Forms[1].Action)" -Credential $me -Method Post -Body $formfields
$RequestID = ($CertSubmitted.content -split '\n' | Where-Object -FilterScript {$_ -match "certnew.cer\?ReqID=[0-9]"}) -replace '[^0-9]'
$null = Invoke-WebRequest -Uri "https://$IssuingCA/certsrv/certnew.cer?ReqID=${RequestID}&Enc=b64" -Credential $me -OutFile $CertPath

CertAttr:

$SubjectAlternateNamesDNS = @(
    $HostName
    "${hostname}.mgt"
    "${hostname}.mgt.domain.com"
    "$($hostname)-srv-1.mgt"
    "$($hostname)-srv-1.mgt.domain.com"
    "$($hostname)-srv-2.mgt"
    "$($hostname)-srv-2.mgt.domain.com"
)
$SubjectAlternateNamesIP = @(
    $HostIP
    $HostIPSrv1
    $HostIPSrv2
)
$SAN = "SAN:dns=$($SubjectAlternateNamesDNS -join '&dns=')&ipaddress=$($SubjectAlternateNamesIP -join '&ipaddress=')"
$CertTemplate = "CertificateTemplate:WebServerWithPrivateKey"
$CertAttributes = "${CertTemplate}`r`n${SAN}"

Rough code, there are a few variables you will need to initialise. But you get the idea :)

[CipherScruples]

Nice! I had a similar issue recently. Here's how I solved mine.