|
2 | 2 | ms.topic: include |
3 | 3 | author: cherylmc |
4 | 4 | ms.service: vpn-gateway |
5 | | - ms.date: 05/23/2022 |
| 5 | + ms.date: 08/04/2023 |
6 | 6 | ms.author: cherylmc |
7 | 7 |
|
8 | 8 | # This include is used for both Virtual WAN and VPN Gateway articles. Any changes you make must apply address both services. |
|
12 | 12 |
|
13 | 13 | Use the New-SelfSignedCertificate cmdlet to create a self-signed root certificate. For additional parameter information, see [New-SelfSignedCertificate](/powershell/module/pki/new-selfsignedcertificate). |
14 | 14 |
|
15 | | -1. From a computer running Windows 10 or later, or Windows Server 2016, open a Windows PowerShell console with elevated privileges. These examples don't work in the Azure Cloud Shell "Try It". You must run these examples locally. |
16 | | -1. Use the following example to create the self-signed root certificate. The following example creates a self-signed root certificate named 'P2SRootCert' that is automatically installed in 'Certificates-Current User\Personal\Certificates'. You can view the certificate by opening *certmgr.msc*, or *Manage User Certificates*. |
| 15 | +1. From a computer running Windows 10 or later, or Windows Server 2016, open a Windows PowerShell console with elevated privileges. |
| 16 | +1. Create a self-signed root certificate. The following example creates a self-signed root certificate named 'P2SRootCert' that's automatically installed in 'Certificates-Current User\Personal\Certificates'. You can view the certificate by opening *certmgr.msc*, or *Manage User Certificates*. |
17 | 17 |
|
18 | | - Run the following example with any necessary modifications. |
| 18 | + Make any needed modifications before using this sample. The 'NotAfter' parameter is optional. By default, without this parameter, the certificate expires in 1 year. |
19 | 19 |
|
20 | 20 | ```powershell |
21 | | - $cert = New-SelfSignedCertificate -Type Custom -KeySpec Signature ` |
22 | | - -Subject "CN=P2SRootCert" -KeyExportPolicy Exportable ` |
23 | | - -HashAlgorithm sha256 -KeyLength 2048 ` |
24 | | - -CertStoreLocation "Cert:\CurrentUser\My" -KeyUsageProperty Sign -KeyUsage CertSign |
| 21 | + $params = @{ |
| 22 | + Type = 'Custom' |
| 23 | + Subject = 'CN=P2SRootCert' |
| 24 | + KeySpec = 'Signature' |
| 25 | + KeyExportPolicy = 'Exportable' |
| 26 | + KeyUsage = 'CertSign' |
| 27 | + KeyUsageProperty = 'Sign' |
| 28 | + KeyLength = 2048 |
| 29 | + HashAlgorithm = 'sha256' |
| 30 | + NotAfter = (Get-Date).AddMonths(24) |
| 31 | + CertStoreLocation = 'Cert:\CurrentUser\My' |
| 32 | + } |
| 33 | + New-SelfSignedCertificate @params |
25 | 34 | ``` |
26 | 35 |
|
27 | 36 | 1. Leave the PowerShell console open and proceed with the next steps to generate a client certificate. |
28 | 37 |
|
29 | 38 | ## <a name="clientcert"></a>Generate a client certificate |
30 | 39 |
|
31 | | -Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You generate a client certificate from the self-signed root certificate, and then export and install the client certificate. If the client certificate isn't installed, authentication fails. |
| 40 | +Each client computer that connects to a VNet using point-to-site must have a client certificate installed. You generate a client certificate from the self-signed root certificate, and then export and install the client certificate. If the client certificate isn't installed, authentication fails. |
32 | 41 |
|
33 | | -The following steps walk you through generating a client certificate from a self-signed root certificate. You may generate multiple client certificates from the same root certificate. When you generate client certificates using the steps below, the client certificate is automatically installed on the computer that you used to generate the certificate. If you want to install a client certificate on another client computer, you can export the certificate. |
| 42 | +The following steps walk you through generating a client certificate from a self-signed root certificate. You may generate multiple client certificates from the same root certificate. When you generate client certificates using the steps below, the client certificate is automatically installed on the computer that you used to generate the certificate. If you want to install a client certificate on another client computer, export the certificate. |
34 | 43 |
|
35 | | -The examples use the New-SelfSignedCertificate cmdlet to generate a client certificate that expires in one year. For additional parameter information, such as setting a different expiration value for the client certificate, see [New-SelfSignedCertificate](/powershell/module/pki/new-selfsignedcertificate). |
| 44 | +The examples use the [New-SelfSignedCertificate](/powershell/module/pki/new-selfsignedcertificate) cmdlet to generate a client certificate. |
36 | 45 |
|
37 | 46 | ### Example 1 - PowerShell console session still open |
38 | 47 |
|
39 | 48 | Use this example if you haven't closed your PowerShell console after creating the self-signed root certificate. This example continues from the previous section and uses the declared '$cert' variable. If you closed the PowerShell console after creating the self-signed root certificate, or are creating additional client certificates in a new PowerShell console session, use the steps in [Example 2](#ex2). |
40 | 49 |
|
41 | | -Modify and run the example to generate a client certificate. If you run the following example without modifying it, the result is a client certificate named 'P2SChildCert'. If you want to name the child certificate something else, modify the CN value. Don't change the TextExtension when running this example. The client certificate that you generate is automatically installed in 'Certificates - Current User\Personal\Certificates' on your computer. |
| 50 | +Modify and run the example to generate a client certificate. If you run the following example without modifying it, the result is a client certificate named 'P2SChildCert'. If you want to name the child certificate something else, modify the CN value. Don't change the TextExtension when running this example. The client certificate that you generate is automatically installed in 'Certificates - Current User\Personal\Certificates' on your computer. |
42 | 51 |
|
43 | 52 | ```powershell |
44 | | -New-SelfSignedCertificate -Type Custom -DnsName P2SChildCert -KeySpec Signature ` |
45 | | --Subject "CN=P2SChildCert" -KeyExportPolicy Exportable ` |
46 | | --HashAlgorithm sha256 -KeyLength 2048 ` |
47 | | --CertStoreLocation "Cert:\CurrentUser\My" ` |
48 | | --Signer $cert -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2") |
| 53 | +
|
| 54 | + $params = @{ |
| 55 | + Type = 'Custom' |
| 56 | + Subject = 'CN=P2SChildCert' |
| 57 | + DnsName = 'P2SChildCert' |
| 58 | + KeySpec = 'Signature' |
| 59 | + KeyExportPolicy = 'Exportable' |
| 60 | + KeyLength = 2048 |
| 61 | + HashAlgorithm = 'sha256' |
| 62 | + NotAfter = (Get-Date).AddMonths(18) |
| 63 | + CertStoreLocation = 'Cert:\CurrentUser\My' |
| 64 | + TextExtension = @( |
| 65 | + '2.5.29.37={text}1.3.6.1.5.5.7.3.2') |
| 66 | + } |
| 67 | + New-SelfSignedCertificate @params |
49 | 68 | ``` |
50 | 69 |
|
51 | 70 | ### <a name="ex2"></a>Example 2 - New PowerShell console session |
@@ -82,11 +101,20 @@ If you're creating additional client certificates, or aren't using the same Powe |
82 | 101 | 1. Modify and run the example to generate a client certificate. If you run the following example without modifying it, the result is a client certificate named 'P2SChildCert'. If you want to name the child certificate something else, modify the CN value. Don't change the TextExtension when running this example. The client certificate that you generate is automatically installed in 'Certificates - Current User\Personal\Certificates' on your computer. |
83 | 102 |
|
84 | 103 | ```powershell |
85 | | - New-SelfSignedCertificate -Type Custom -DnsName P2SChildCert -KeySpec Signature ` |
86 | | - -Subject "CN=P2SChildCert" -KeyExportPolicy Exportable ` |
87 | | - -HashAlgorithm sha256 -KeyLength 2048 ` |
88 | | - -CertStoreLocation "Cert:\CurrentUser\My" ` |
89 | | - -Signer $cert -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2") |
| 104 | + $params = @{ |
| 105 | + Type = 'Custom' |
| 106 | + Subject = 'CN=P2SChildCert' |
| 107 | + DnsName = 'P2SChildCert1' |
| 108 | + KeySpec = 'Signature' |
| 109 | + KeyExportPolicy = 'Exportable' |
| 110 | + KeyLength = 2048 |
| 111 | + HashAlgorithm = 'sha256' |
| 112 | + NotAfter = (Get-Date).AddMonths(18) |
| 113 | + CertStoreLocation = 'Cert:\CurrentUser\My' |
| 114 | + TextExtension = @( |
| 115 | + '2.5.29.37={text}1.3.6.1.5.5.7.3.2') |
| 116 | + } |
| 117 | + New-SelfSignedCertificate @params |
90 | 118 | ``` |
91 | 119 |
|
92 | 120 | ## <a name="cer"></a>Export the root certificate public key (.cer) |
|
0 commit comments