You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: 'Generate & export certificates for P2S User VPN: MakeCert'
3
+
titleSuffix: Azure Virtual WAN
4
+
description: Learn how to create a self-signed root certificate for User VPN, export a public key, and generate client certificates using MakeCert.
5
+
author: cherylmc
6
+
ms.service: azure-virtual-wan
7
+
ms.topic: how-to
8
+
ms.date: 02/13/2025
9
+
ms.author: cherylmc
10
+
11
+
---
12
+
# Generate and export certificates for User VPN P2S connections using MakeCert
13
+
14
+
This article shows you how to create a self-signed root certificate and generate client certificates using MakeCert. The steps in this article help you create **.pfx** and **.cer** files. For **.pem** files, see [Generate .pem certificate files](../vpn-gateway/point-to-site-certificates-linux-openssl.md).
15
+
16
+
> [!NOTE]
17
+
> We recommend using the [PowerShell steps](certificates-point-to-site.md) instead to create your certificates. We provide these MakeCert instructions as an optional method.
18
+
19
+
MakeCert is deprecated. This means that this tool could be removed at any point. Certificates that you already generated using MakeCert aren't affected if MakeCert is no longer available. MakeCert is only used to generate the certificates, not as a validating mechanism.
Copy file name to clipboardExpand all lines: articles/virtual-wan/certificates-point-to-site.md
+4-9Lines changed: 4 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,29 +4,24 @@ titleSuffix: Azure Virtual WAN
4
4
description: Learn how to create a self-signed root certificate, export a public key, and generate client certificates for Virtual WAN User VPN (point-to-site) connections using PowerShell.
5
5
author: cherylmc
6
6
ms.service: azure-virtual-wan
7
-
ms.custom: linux-related-content
8
7
ms.topic: how-to
9
-
ms.date: 08/23/2023
8
+
ms.date: 02/13/2025
10
9
ms.author: cherylmc
11
10
---
12
11
# Generate and export certificates for User VPN connections using PowerShell
13
12
14
-
User VPN (point-to-site) configurations can be configured to require certificates to authenticate. This article shows you how to create a self-signed root certificate and generate client certificates using PowerShell on Windows 10 (or later) or Windows Server 2016 (or later).
13
+
This article shows you how to create a self-signed root certificate and generate client certificates using PowerShell on Windows 10 or later, or Windows Server 2016 or later. The steps in this article help you create **.pfx** and **.cer** files. For **.pem** files, see the Linux [OpenSSL](../vpn-gateway/point-to-site-certificates-linux-openssl.md) or [strongSwan](../vpn-gateway/vpn-gateway-certificates-point-to-site-linux.md) article.
15
14
16
15
The PowerShell cmdlets that you use to generate certificates are part of the operating system and don't work on other versions of Windows. The host operating system is only used to generate the certificates. Once the certificates are generated, you can upload them or install them on any supported client operating system.
17
16
18
-
If you don't have a computer that meets the operating system requirement, you can use [MakeCert](../vpn-gateway/vpn-gateway-certificates-point-to-site-makecert.md) to generate certificates. The certificates that you generate using either method can be installed on any supported client operating system.
17
+
If you don't have a computer that meets the operating system requirement for these instructions, you can either use a small Windows virtual machine as a workaround, or use [MakeCert](certificates-point-to-site-makecert.md) to generate certificates. The certificates that you generate using either method can be installed on any supported client operating system.
19
18
20
19
[!INCLUDE [Generate and export - this include is for both vpn-gateway and virtual-wan](../../includes/vpn-gateway-generate-export-certificates-include.md)]
21
20
22
-
## Linux
23
-
24
-
For Linux steps, see [Generate self-signed certificates - Linux - OpenSSL](../vpn-gateway/point-to-site-certificates-linux-openssl.md) or [Generate self-signed certificates - Linux - strongSwan](../vpn-gateway/vpn-gateway-certificates-point-to-site-linux.md).
25
-
26
21
## Install an exported client certificate
27
22
28
23
Each client that connects over a P2S connection requires a client certificate to be installed locally. For steps to install a certificate, see [Install client certificates](install-client-certificates.md).
29
24
30
25
## Next steps
31
26
32
-
Continue with the[Virtual WAN steps for user VPN connections](virtual-wan-point-to-site-portal.md#p2sconfig).
27
+
To continue with your point-to-site configuration, see[Virtual WAN steps for user VPN connections](virtual-wan-point-to-site-portal.md#p2sconfig).
Copy file name to clipboardExpand all lines: articles/virtual-wan/install-client-certificates.md
+9-3Lines changed: 9 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ author: cherylmc
6
6
ms.service: azure-virtual-wan
7
7
ms.custom: linux-related-content
8
8
ms.topic: how-to
9
-
ms.date: 05/15/2024
9
+
ms.date: 02/13/2025
10
10
ms.author: cherylmc
11
11
---
12
12
# Install client certificates for User VPN connections
@@ -25,8 +25,14 @@ If you want to generate a client certificate, see [Generate and export certifica
25
25
26
26
## <aname="installlinux"></a>Linux
27
27
28
-
The Linux client certificate is installed on the client as part of the client configuration. There are a few different methods to install certificates. You can use [strongSwan](../vpn-gateway/point-to-site-vpn-client-certificate-ike-linux.md) steps, or [OpenVPN client](../vpn-gateway/point-to-site-vpn-client-certificate-openvpn-linux.md).
28
+
The Linux client certificate is installed on the client as part of the client configuration. There are a few different methods to install certificates. You can use [strongSwan](point-to-site-vpn-client-certificate-ike-linux.md), or [OpenVPN client](point-to-site-vpn-client-certificate-openvpn-linux.md) steps.
29
+
30
+
## <aname="vpn-clients"></a>Configure VPN clients
31
+
32
+
To continue configuration, go back to the VPN client instructions that you were working with. You can use this table to locate the link:
Continue with the [Virtual WAN User VPN](virtual-wan-point-to-site-portal.md#p2sconfig) configuration steps.
38
+
For P2S server configuration, see [Configure User VPN settings for certificate authentication](virtual-wan-point-to-site-portal.md#p2sconfig) configuration steps.
Copy file name to clipboardExpand all lines: articles/vpn-gateway/point-to-site-how-to-vpn-client-install-azure-cert.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ author: cherylmc
6
6
ms.service: azure-vpn-gateway
7
7
ms.custom: linux-related-content
8
8
ms.topic: how-to
9
-
ms.date: 05/15/2024
9
+
ms.date: 02/13/2025
10
10
ms.author: cherylmc
11
11
---
12
12
# Install client certificates for P2S certificate authentication connections
@@ -25,14 +25,14 @@ For information about generating certificates, see the [Generate certificates](p
25
25
26
26
## <aname="installlinux"></a>Linux
27
27
28
-
The Linux client certificate is installed on the client as part of the client configuration. There are a few different methods to install certificates. You can use [strongSwan](point-to-site-vpn-client-certificate-ike-linux.md) steps, or [OpenVPN client](point-to-site-vpn-client-certificate-openvpn-linux.md).
28
+
The Linux client certificate is installed on the client as part of the client configuration. There are a few different methods to install certificates. You can use [strongSwan](point-to-site-vpn-client-certificate-ike-linux.md), or [OpenVPN client](point-to-site-vpn-client-certificate-openvpn-linux.md) steps.
29
29
30
30
## <aname="vpn-clients"></a>Configure VPN clients
31
31
32
-
To continue configuration, go back to the client that you were working on. You can use this table to easily locate the link:
32
+
To continue configuration, go back to the VPN client instructions that you were working with. You can use this table to locate the link:
Continue with the Point-to-Site configuration steps to Create and install VPN client configuration files. Use the links in the [VPN client table](#vpn-clients).
38
+
For P2S server configuration, see [Configure P2S server settings for certificate authentication](point-to-site-certificate-gateway.md) configuration steps.
Copy file name to clipboardExpand all lines: articles/vpn-gateway/vpn-gateway-certificates-point-to-site-makecert.md
+8-55Lines changed: 8 additions & 55 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,64 +5,20 @@ description: Learn how to create a self-signed root certificate, export a public
5
5
author: cherylmc
6
6
ms.service: azure-vpn-gateway
7
7
ms.topic: how-to
8
-
ms.date: 06/24/2024
8
+
ms.date: 02/13/2025
9
9
ms.author: cherylmc
10
10
11
11
---
12
12
# Generate and export certificates for Point-to-Site connections using MakeCert
13
13
14
-
This article shows you how to create a self-signed root certificate and generate client certificates using MakeCert. The steps in this article help you create **.pfx** and **.cer** files. If you're looking for different certificate instructions, see [PowerShell - .pfx and .cer certificate files](vpn-gateway-certificates-point-to-site.md) or [Linux- OpenSSL - .pem certificate files](point-to-site-certificates-linux-openssl.md).
14
+
This article shows you how to create a self-signed root certificate and generate client certificates using MakeCert. The steps in this article help you create **.pfx** and **.cer** files. For **.pem** files, see [Generate .pem certificate files](point-to-site-certificates-linux-openssl.md).
15
15
16
-
We recommend using the [Windows 10 or later PowerShell steps](vpn-gateway-certificates-point-to-site.md) to create your certificates. We provide these MakeCert instructions as an optional method. The certificates that you generate using either method can be installed on [any supported client operating system](point-to-site-certificate-gateway.md#faq). MakeCert has the following limitation:
16
+
> [!NOTE]
17
+
> We recommend using the [PowerShell steps](vpn-gateway-certificates-point-to-site.md) instead to create your certificates. We provide these MakeCert instructions as an optional method.
17
18
18
-
*MakeCert is deprecated. This means that this tool could be removed at any point. Certificates that you already generated using MakeCert won't be affected if MakeCert is no longer available. MakeCert is only used to generate the certificates, not as a validating mechanism.
19
+
MakeCert is deprecated. This means that this tool could be removed at any point. Certificates that you already generated using MakeCert aren't affected if MakeCert is no longer available. MakeCert is only used to generate the certificates, not as a validating mechanism.
19
20
20
-
## <aname="rootcert"></a>Create a self-signed root certificate
21
-
22
-
The following steps show you how to create a self-signed certificate using MakeCert. These steps aren't deployment-model specific. They're valid for both Resource Manager and classic.
23
-
24
-
1. Download and install [MakeCert](/windows/win32/seccrypto/makecert).
25
-
2. After installation, you can typically find the makecert.exe utility under this path: 'C:\Program Files (x86)\Windows Kits\10\bin\<arch>'. However, it's possible that it was installed to another location. Open a command prompt as administrator and navigate to the location of the MakeCert utility. You can use the following example, adjusting for the proper location:
26
-
27
-
```cmd
28
-
cd C:\Program Files (x86)\Windows Kits\10\bin\x64
29
-
```
30
-
3. Create and install a certificate in the Personal certificate store on your computer. The following example creates a corresponding *.cer* file that you upload to Azure when configuring P2S. Replace 'P2SRootCert' and 'P2SRootCert.cer' with the name that you want to use for the certificate. The certificate is located in your 'Certificates - Current User\Personal\Certificates'.
31
-
32
-
```cmd
33
-
makecert -sky exchange -r -n "CN=P2SRootCert" -pe -a sha256 -len 2048 -ss My
34
-
```
35
-
36
-
## <aname="cer"></a>Export the public key (.cer)
37
-
38
-
[!INCLUDE [Export public key](../../includes/vpn-gateway-certificates-export-public-key-include.md)]
39
-
40
-
The exported.cer file must be uploaded to Azure. For instructions, see [Configure a Point-to-Site connection](point-to-site-certificate-gateway.md#uploadfile). To add an additional trusted root certificate, see [this section](point-to-site-certificate-gateway.md#add) of the article.
41
-
42
-
### Export the self-signed certificate and private key to store it (optional)
43
-
44
-
You might want to export the self-signed root certificate and store it safely. You can later install it on another computer and generate more client certificates, or export another .cer file. To export the self-signed root certificate as a .pfx, select the root certificate and use the same steps as described in [Export a client certificate](#clientexport).
45
-
46
-
## Create and install client certificates
47
-
48
-
You don't install the self-signed certificate directly on the client computer. You need to generate a client certificate from the self-signed certificate. You then export and install the client certificate to the client computer. The following steps aren't deployment-model specific. They're valid for both Resource Manager and classic.
49
-
50
-
### <aname="clientcert"></a>Generate a client certificate
51
-
52
-
Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You generate a client certificate from the self-signed root certificate, and then export and install the client certificate. If the client certificate isn't installed, authentication fails.
53
-
54
-
The following steps walk you through generating a client certificate from a self-signed root certificate. You can generate multiple client certificates from the same root certificate. When you generate client certificates using the following steps, the client certificate is automatically installed on the computer that you used to generate the certificate. If you want to install a client certificate on another client computer, you can export the certificate.
55
-
56
-
1. On the same computer that you used to create the self-signed certificate, open a command prompt as administrator.
57
-
2. Modify and run the sample to generate a client certificate.
58
-
* Change *"P2SRootCert"* to the name of the self-signed root that you're generating the client certificate from. Make sure you're using the name of the root certificate, which is whatever the 'CN=' value was that you specified when you created the self-signed root.
59
-
* Change *P2SChildCert* to the name you want to generate a client certificate to be.
60
-
61
-
If you run the following example without modifying it, the result is a client certificate named P2SChildcert in your Personal certificate store that was generated from root certificate P2SRootCert.
62
-
63
-
```cmd
64
-
makecert.exe -n "CN=P2SChildCert" -pe -sky exchange -m 96 -ss My -in "P2SRootCert" -is my -a sha256
### <aname="clientexport"></a>Export a client certificate
68
24
@@ -74,9 +30,6 @@ To install a client certificate, see [Install a client certificate](point-to-sit
74
30
75
31
## Next steps
76
32
77
-
Continue with your Point-to-Site configuration.
78
-
79
-
* For **Resource Manager** deployment model steps, see [Configure P2S using native Azure certificate authentication](point-to-site-certificate-gateway.md).
80
-
* For **classic** deployment model steps, see [Configure a Point-to-Site VPN connection to a VNet (classic)](vpn-gateway-howto-point-to-site-classic-azure-portal.md).
33
+
To continue with your Point-to-Site configuration, see [Configure server settings for P2S VPN Gateway certificate authentication](point-to-site-certificate-gateway.md).
81
34
82
-
For P2S troubleshooting information, [Troubleshooting Azure point-to-site connections](vpn-gateway-troubleshoot-vpn-point-to-site-connection-problems.md).
35
+
For P2S troubleshooting information, see [Troubleshooting Azure point-to-site connections](vpn-gateway-troubleshoot-vpn-point-to-site-connection-problems.md).
Copy file name to clipboardExpand all lines: articles/vpn-gateway/vpn-gateway-certificates-point-to-site.md
+3-6Lines changed: 3 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ description: Learn how to create a self-signed root certificate, export a public
5
5
author: cherylmc
6
6
ms.service: azure-vpn-gateway
7
7
ms.topic: how-to
8
-
ms.date: 06/24/2024
8
+
ms.date: 02/13/2025
9
9
ms.author: cherylmc
10
10
11
11
---
@@ -15,7 +15,7 @@ This article shows you how to create a self-signed root certificate and generate
15
15
16
16
The PowerShell cmdlets that you use to generate certificates are part of the operating system and don't work on other versions of Windows. The host operating system is only used to generate the certificates. Once the certificates are generated, you can upload them or install them on any supported client operating system.
17
17
18
-
If you don't have a computer that meets the operating system requirement, you can use [MakeCert](vpn-gateway-certificates-point-to-site-makecert.md) to generate certificates. The certificates that you generate using either method can be installed on any [supported](point-to-site-certificate-gateway.md#faq) client operating system.
18
+
If you don't have a computer that meets the operating system requirement for these instructions, you can either use a small Windows virtual machine as a workaround, or use [MakeCert](vpn-gateway-certificates-point-to-site-makecert.md) to generate certificates. The certificates that you generate using either method can be installed on any supported client operating system.
19
19
20
20
[!INCLUDE [Generate and export - this include is for both vpn-gateway and virtual-wan](../../includes/vpn-gateway-generate-export-certificates-include.md)]
21
21
@@ -25,7 +25,4 @@ Each client that connects over a P2S connection requires a client certificate to
25
25
26
26
## Next steps
27
27
28
-
Continue with your point-to-site configuration.
29
-
30
-
* For **Resource Manager** deployment model steps, see [Configure P2S using native Azure certificate authentication](point-to-site-certificate-gateway.md).
31
-
* For **classic** deployment model steps, see [Configure a point-to-site VPN connection to a VNet (classic)](vpn-gateway-howto-point-to-site-classic-azure-portal.md).
28
+
To continue with your Point-to-Site configuration, see [Configure server settings for P2S VPN Gateway certificate authentication](point-to-site-certificate-gateway.md).
0 commit comments