update

Author: cherylmc

articles/vpn-gateway/vpn-gateway-certificates-point-to-site.md

@@ -5,7 +5,7 @@ description: Learn how to create a self-signed root certificate, export a public
 author: cherylmc
 ms.service: vpn-gateway
 ms.topic: how-to
-ms.date: 07/06/2022
+ms.date: 08/04/2023
 ms.author: cherylmc
 
 ---

articles/vpn-gateway/vpn-gateway-howto-point-to-site-rm-ps.md

@@ -12,7 +12,7 @@ ms.custom: devx-track-azurepowershell
 ---
 # Configure server settings for P2S VPN certificate authentication - PowerShell
 
-This article helps you configure a point-to-site (P2S) VPN to securely connect individual clients running Windows, Linux, or macOS to an Azure virtual network (VNet). P2S VPN connections are useful when you want to connect to your VNet from a remote location, such when you're telecommuting from home or a conference. 
+This article helps you configure a point-to-site (P2S) VPN to securely connect individual clients running Windows, Linux, or macOS to an Azure virtual network (VNet). P2S VPN connections are useful when you want to connect to your VNet from a remote location, such when you're telecommuting from home or a conference.
 
 You can also use P2S instead of a Site-to-Site VPN when you have only a few clients that need to connect to a VNet. P2S connections don't require a VPN device or a public-facing IP address. P2S creates the VPN connection over either SSTP (Secure Socket Tunneling Protocol), or IKEv2.
 
@@ -125,22 +125,22 @@ In this step, you configure and create the virtual network gateway for your VNet
 
 After the VPN gateway finishes creating, you can add the VPN client address pool. The VPN client address pool is the range from which the VPN clients receive an IP address when connecting. Use a private IP address range that doesn't overlap with the on-premises location that you connect from, or with the VNet that you want to connect to.
 
-Declare the following variables:
+1. Declare the following variables:
 
-```azurepowershell-interactive
-$VNetName  = "VNet1"
-$VPNClientAddressPool = "172.16.201.0/24"
-$RG = "TestRG1"
-$Location = "EastUS"
-$GWName = "VNet1GW"
-```
+   ```azurepowershell-interactive
+   $VNetName  = "VNet1"
+   $VPNClientAddressPool = "172.16.201.0/24"
+   $RG = "TestRG1"
+   $Location = "EastUS"
+   $GWName = "VNet1GW"
+   ```
 
-Add the VPN client address pool:
+1. Add the VPN client address pool:
 
-```azurepowershell-interactive
-$Gateway = Get-AzVirtualNetworkGateway -ResourceGroupName $RG -Name $GWName
-Set-AzVirtualNetworkGateway -VirtualNetworkGateway $Gateway -VpnClientAddressPool $VPNClientAddressPool
-```
+   ```azurepowershell-interactive
+   $Gateway = Get-AzVirtualNetworkGateway -ResourceGroupName $RG -Name $GWName
+   Set-AzVirtualNetworkGateway -VirtualNetworkGateway $Gateway -VpnClientAddressPool $VPNClientAddressPool
+   ```
 
 ## <a name="Certificates"></a>Generate certificates
 

includes/vpn-gateway-generate-export-certificates-include.md

@@ -2,7 +2,7 @@
  ms.topic: include
  author: cherylmc
  ms.service: vpn-gateway
- ms.date: 05/23/2022
+ ms.date: 08/04/2023
  ms.author: cherylmc
 
 # This include is used for both Virtual WAN and VPN Gateway articles. Any changes you make must apply address both services.
@@ -15,20 +15,29 @@ Use the New-SelfSignedCertificate cmdlet to create a self-signed root certificat
 1. From a computer running Windows 10 or later, or Windows Server 2016, open a Windows PowerShell console with elevated privileges. These examples don't work in the Azure Cloud Shell "Try It". You must run these examples locally.
 1. Use the following example to create the self-signed root certificate. The following example creates a self-signed root certificate named 'P2SRootCert' that is automatically installed in 'Certificates-Current User\Personal\Certificates'. You can view the certificate by opening *certmgr.msc*, or *Manage User Certificates*.
 
-   Run the following example with any necessary modifications.
+   Run the following example with any necessary modifications. The following certificate includes the 'NotAfter' parameter, which is optional. By default, without this parameter, the certificate expires in 1 year.
 
    ```powershell
-   $cert = New-SelfSignedCertificate -Type Custom -KeySpec Signature `
-   -Subject "CN=P2SRootCert" -KeyExportPolicy Exportable `
-   -HashAlgorithm sha256 -KeyLength 2048 `
-   -CertStoreLocation "Cert:\CurrentUser\My" -KeyUsageProperty Sign -KeyUsage CertSign
+   $params = @{
+       Type = 'Custom'
+       Subject = 'CN=P2SRootCert'
+       KeySpec = 'Signature'
+       KeyExportPolicy = 'Exportable'
+       KeyUsage = 'CertSign'
+       KeyUsageProperty = 'Sign'
+       KeyLength = 2048
+       HashAlgorithm = 'sha256'
+       NotAfter = (Get-Date).AddMonths(24)
+       CertStoreLocation = 'Cert:\CurrentUser\My'
+   }
+   New-SelfSignedCertificate @params
    ```
 
 1. Leave the PowerShell console open and proceed with the next steps to generate a client certificate.
 
 ## <a name="clientcert"></a>Generate a client certificate
 
-Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You generate a client certificate from the self-signed root certificate, and then export and install the client certificate. If the client certificate isn't installed, authentication fails. 
+Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You generate a client certificate from the self-signed root certificate, and then export and install the client certificate. If the client certificate isn't installed, authentication fails.
 
 The following steps walk you through generating a client certificate from a self-signed root certificate. You may generate multiple client certificates from the same root certificate. When you generate client certificates using the steps below, the client certificate is automatically installed on the computer that you used to generate the certificate. If you want to install a client certificate on another client computer, you can export the certificate.
 
@@ -38,14 +47,24 @@ The examples use the New-SelfSignedCertificate cmdlet to generate a client certi
 
 Use this example if you haven't closed your PowerShell console after creating the self-signed root certificate. This example continues from the previous section and uses the declared '$cert' variable. If you closed the PowerShell console after creating the self-signed root certificate, or are creating additional client certificates in a new PowerShell console session, use the steps in [Example 2](#ex2).
 
-Modify and run the example to generate a client certificate. If you run the following example without modifying it, the result is a client certificate named 'P2SChildCert'.  If you want to name the child certificate something else, modify the CN value. Don't change the TextExtension when running this example. The client certificate that you generate is automatically installed in 'Certificates - Current User\Personal\Certificates' on your computer.
+Modify and run the example to generate a client certificate. If you run the following example without modifying it, the result is a client certificate named 'P2SChildCert'. If you want to name the child certificate something else, modify the CN value. Don't change the TextExtension when running this example. The client certificate that you generate is automatically installed in 'Certificates - Current User\Personal\Certificates' on your computer.
 
 ```powershell
-New-SelfSignedCertificate -Type Custom -DnsName P2SChildCert -KeySpec Signature `
--Subject "CN=P2SChildCert" -KeyExportPolicy Exportable `
--HashAlgorithm sha256 -KeyLength 2048 `
--CertStoreLocation "Cert:\CurrentUser\My" `
--Signer $cert -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2")
+
+   $params = @{
+       Type = 'Custom'
+       Subject = 'CN=P2SChildCert'
+       DnsName = 'P2SChildCert'
+       KeySpec = 'Signature'
+       KeyExportPolicy = 'Exportable'
+       KeyLength = 2048
+       HashAlgorithm = 'sha256'
+       NotAfter = (Get-Date).AddMonths(18)
+       CertStoreLocation = 'Cert:\CurrentUser\My'
+       TextExtension = @(
+        '2.5.29.37={text}1.3.6.1.5.5.7.3.2')
+   }
+   New-SelfSignedCertificate @params
 ```
 
 ### <a name="ex2"></a>Example 2 - New PowerShell console session
@@ -82,11 +101,20 @@ If you're creating additional client certificates, or aren't using the same Powe
 1. Modify and run the example to generate a client certificate. If you run the following example without modifying it, the result is a client certificate named 'P2SChildCert'. If you want to name the child certificate something else, modify the CN value. Don't change the TextExtension when running this example. The client certificate that you generate is automatically installed in 'Certificates - Current User\Personal\Certificates' on your computer.
 
    ```powershell
-   New-SelfSignedCertificate -Type Custom -DnsName P2SChildCert -KeySpec Signature `
-   -Subject "CN=P2SChildCert" -KeyExportPolicy Exportable `
-   -HashAlgorithm sha256 -KeyLength 2048 `
-   -CertStoreLocation "Cert:\CurrentUser\My" `
-   -Signer $cert -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2")
+   $params = @{
+       Type = 'Custom'
+       Subject = 'CN=P2SChildCert'
+       DnsName = 'P2SChildCert1'
+       KeySpec = 'Signature'
+       KeyExportPolicy = 'Exportable'
+       KeyLength = 2048
+       HashAlgorithm = 'sha256'
+       NotAfter = (Get-Date).AddMonths(18)
+       CertStoreLocation = 'Cert:\CurrentUser\My'
+       TextExtension = @(
+        '2.5.29.37={text}1.3.6.1.5.5.7.3.2')
+   }
+   New-SelfSignedCertificate @params
    ```
 
 ## <a name="cer"></a>Export the root certificate public key (.cer)

includes/vpn-gateway-p2s-rootcert-include.md

@@ -2,14 +2,14 @@
  ms.topic: include
  author: cherylmc
  ms.service: vpn-gateway
- ms.date: 05/23/2022
+ ms.date: 08/04/2023
  ms.author: cherylmc
 ---
 Obtain the .cer file for the root certificate. You can use either a root certificate that was generated with an enterprise solution (recommended), or generate a self-signed certificate. After you create the root certificate, export the public certificate data (not the private key) as a Base64 encoded X.509 .cer file. You upload this file later to Azure.
 
 * **Enterprise certificate:** If you're using an enterprise solution, you can use your existing certificate chain. Acquire the .cer file for the root certificate that you want to use.
 * **Self-signed root certificate:** If you aren't using an enterprise certificate solution, create a self-signed root certificate. Otherwise, the certificates you create won't be compatible with your P2S connections and clients will receive a connection error when they try to connect. You can use Azure PowerShell, MakeCert, or OpenSSL. The steps in the following articles describe how to generate a compatible self-signed root certificate:
 
-  * [Windows 10 or later PowerShell instructions](../articles/vpn-gateway/vpn-gateway-certificates-point-to-site.md): These instructions require Windows 10 or later and PowerShell to generate certificates. Client certificates that are generated from the root certificate can be installed on any supported P2S client.
-  * [MakeCert instructions](../articles/vpn-gateway/vpn-gateway-certificates-point-to-site-makecert.md): Use MakeCert if you don't have access to a Windows 10 or later computer to use to generate certificates. Although MakeCert is deprecated, you can still use it to generate certificates. Client certificates that you generate from the root certificate can be installed on any supported P2S client.
+  * [PowerShell instructions for Windows 10 or later](../articles/vpn-gateway/vpn-gateway-certificates-point-to-site.md): These instructions require PowerShell on a computer running Windows 10 or later. Client certificates that are generated from the root certificate can be installed on any supported P2S client.
+  * [MakeCert instructions](../articles/vpn-gateway/vpn-gateway-certificates-point-to-site-makecert.md): Use MakeCert to generate certificates if you don't have access to a computer running Windows 10 or later. Although MakeCert is deprecated, you can still use it to generate certificates. Client certificates that you generate from the root certificate can be installed on any supported P2S client.
   * [Linux instructions](../articles/vpn-gateway/vpn-gateway-certificates-point-to-site-linux.md).