Skip to content

Commit fb8caab

Browse files
tiburdtiburd
authored
Merge pull request #91314 from cherylmc/p2s
includes
2 parents 73f5f71 + 02e1ec4 commit fb8caab

File tree

2 files changed

+104
-95
lines changed

2 files changed

+104
-95
lines changed

‎articles/vpn-gateway/vpn-gateway-certificates-point-to-site.md

Lines changed: 7 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -2,121 +2,33 @@
22
title: 'Generate and export certificates for Point-to-Site: PowerShell: Azure | Microsoft Docs'
33
description: Create a self-signed root certificate, export the public key, and generate client certificates using PowerShell on Windows 10 or Windows Server 2016.
44
services: vpn-gateway
5-
documentationcenter: na
65
author: cherylmc
76

87
ms.service: vpn-gateway
98
ms.topic: conceptual
10-
ms.date: 12/03/2018
9+
ms.date: 10/10/2019
1110
ms.author: cherylmc
1211

1312
---
1413
# Generate and export certificates for Point-to-Site using PowerShell
1514

1615
Point-to-Site connections use certificates to authenticate. This article shows you how to create a self-signed root certificate and generate client certificates using PowerShell on Windows 10 or Windows Server 2016. If you are looking for different certificate instructions, see [Certificates - Linux](vpn-gateway-certificates-point-to-site-linux.md) or [Certificates - MakeCert](vpn-gateway-certificates-point-to-site-makecert.md).
1716

18-
You must perform the steps in this article on a computer running Windows 10 or Windows Server 2016. The PowerShell cmdlets that you use to generate certificates are part of the operating system and do not work on other versions of Windows. The Windows 10 or Windows Server 2016 computer is only needed to generate the certificates. Once the certificates are generated, you can upload them, or install them on any supported client operating system.
17+
You must perform the steps in this article on a computer running Windows 10 or Windows Server 2016. The PowerShell cmdlets that you use to generate certificates are part of the operating system and do not work on other versions of Windows. The Windows 10 or Windows Server 2016 computer is only needed to generate the certificates. Once the certificates are generated, you can upload them, or install them on any supported client operating system.
1918

2019
If you do not have access to a Windows 10 or Windows Server 2016 computer, you can use [MakeCert](vpn-gateway-certificates-point-to-site-makecert.md) to generate certificates. The certificates that you generate using either method can be installed on any [supported](vpn-gateway-howto-point-to-site-resource-manager-portal.md#faq) client operating system.
2120

22-
## <a name="rootcert"></a>1. Create a self-signed root certificate
21+
[!INCLUDE [generate and export certificates](../../includes/vpn-gateway-generate-export-certificates-include.md)]
2322

24-
Use the New-SelfSignedCertificate cmdlet to create a self-signed root certificate. For additional parameter information, see [New-SelfSignedCertificate](https://technet.microsoft.com/itpro/powershell/windows/pkiclient/new-selfsignedcertificate).
25-
26-
1. From a computer running Windows 10 or Windows Server 2016, open a Windows PowerShell console with elevated privileges. These examples do not work in the Azure Cloud Shell "Try It". You must run these examples locally.
27-
2. Use the following example to create the self-signed root certificate. The following example creates a self-signed root certificate named 'P2SRootCert' that is automatically installed in 'Certificates-Current User\Personal\Certificates'. You can view the certificate by opening *certmgr.msc*, or *Manage User Certificates*.
28-
29-
```powershell
30-
$cert = New-SelfSignedCertificate -Type Custom -KeySpec Signature `
31-
-Subject "CN=P2SRootCert" -KeyExportPolicy Exportable `
32-
-HashAlgorithm sha256 -KeyLength 2048 `
33-
-CertStoreLocation "Cert:\CurrentUser\My" -KeyUsageProperty Sign -KeyUsage CertSign
34-
```
35-
36-
## <a name="clientcert"></a>2. Generate a client certificate
37-
38-
Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You generate a client certificate from the self-signed root certificate, and then export and install the client certificate. If the client certificate is not installed, authentication fails.
39-
40-
The following steps walk you through generating a client certificate from a self-signed root certificate. You may generate multiple client certificates from the same root certificate. When you generate client certificates using the steps below, the client certificate is automatically installed on the computer that you used to generate the certificate. If you want to install a client certificate on another client computer, you can export the certificate.
41-
42-
The examples use the New-SelfSignedCertificate cmdlet to generate a client certificate that expires in one year. For additional parameter information, such as setting a different expiration value for the client certificate, see [New-SelfSignedCertificate](https://technet.microsoft.com/itpro/powershell/windows/pkiclient/new-selfsignedcertificate).
43-
44-
### Example 1
45-
46-
Use this example if you have not closed your PowerShell console after creating the self-signed root certificate. This example continues from the previous section and uses the declared '$cert' variable. If you closed the PowerShell console after creating the self-signed root certificate, or are creating additional client certificates in a new PowerShell console session, use the steps in [Example 2](#ex2).
47-
48-
Modify and run the example to generate a client certificate. If you run the following example without modifying it, the result is a client certificate named 'P2SChildCert'. If you want to name the child certificate something else, modify the CN value. Do not change the TextExtension when running this example. The client certificate that you generate is automatically installed in 'Certificates - Current User\Personal\Certificates' on your computer.
49-
50-
```powershell
51-
New-SelfSignedCertificate -Type Custom -DnsName P2SChildCert -KeySpec Signature `
52-
-Subject "CN=P2SChildCert" -KeyExportPolicy Exportable `
53-
-HashAlgorithm sha256 -KeyLength 2048 `
54-
-CertStoreLocation "Cert:\CurrentUser\My" `
55-
-Signer $cert -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2")
56-
```
57-
58-
### <a name="ex2"></a>Example 2
59-
60-
If you are creating additional client certificates, or are not using the same PowerShell session that you used to create your self-signed root certificate, use the following steps:
61-
62-
1. Identify the self-signed root certificate that is installed on the computer. This cmdlet returns a list of certificates that are installed on your computer.
63-
64-
```powershell
65-
Get-ChildItem -Path “Cert:\CurrentUser\My”
66-
```
67-
2. Locate the subject name from the returned list, then copy the thumbprint that is located next to it to a text file. In the following example, there are two certificates. The CN name is the name of the self-signed root certificate from which you want to generate a child certificate. In this case, 'P2SRootCert'.
68-
69-
```
70-
Thumbprint Subject
71-
72-
AED812AD883826FF76B4D1D5A77B3C08EFA79F3F CN=P2SChildCert4
73-
7181AA8C1B4D34EEDB2F3D3BEC5839F3FE52D655 CN=P2SRootCert
74-
```
75-
3. Declare a variable for the root certificate using the thumbprint from the previous step. Replace THUMBPRINT with the thumbprint of the root certificate from which you want to generate a child certificate.
76-
77-
```powershell
78-
$cert = Get-ChildItem -Path "Cert:\CurrentUser\My\THUMBPRINT"
79-
```
80-
81-
For example, using the thumbprint for P2SRootCert in the previous step, the variable looks like this:
82-
83-
```powershell
84-
$cert = Get-ChildItem -Path "Cert:\CurrentUser\My\7181AA8C1B4D34EEDB2F3D3BEC5839F3FE52D655"
85-
```
86-
4. Modify and run the example to generate a client certificate. If you run the following example without modifying it, the result is a client certificate named 'P2SChildCert'. If you want to name the child certificate something else, modify the CN value. Do not change the TextExtension when running this example. The client certificate that you generate is automatically installed in 'Certificates - Current User\Personal\Certificates' on your computer.
87-
88-
```powershell
89-
New-SelfSignedCertificate -Type Custom -DnsName P2SChildCert -KeySpec Signature `
90-
-Subject "CN=P2SChildCert" -KeyExportPolicy Exportable `
91-
-HashAlgorithm sha256 -KeyLength 2048 `
92-
-CertStoreLocation "Cert:\CurrentUser\My" `
93-
-Signer $cert -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2")
94-
```
95-
96-
## <a name="cer"></a>3. Export the root certificate public key (.cer)
97-
98-
[!INCLUDE [Export public key](../../includes/vpn-gateway-certificates-export-public-key-include.md)]
99-
100-
101-
### Export the self-signed root certificate and private key to store it (optional)
102-
103-
You may want to export the self-signed root certificate and store it safely as backup. If need be, you can later install it on another computer and generate more client certificates. To export the self-signed root certificate as a .pfx, select the root certificate and use the same steps as described in [Export a client certificate](#clientexport).
104-
105-
## <a name="clientexport"></a>4. Export the client certificate
106-
107-
[!INCLUDE [Export client certificate](../../includes/vpn-gateway-certificates-export-client-cert-include.md)]
108-
109-
110-
## <a name="install"></a>5. Install an exported client certificate
23+
## <a name="install"></a>Install an exported client certificate
11124

11225
Each client that connects to the VNet over a P2S connection requires a client certificate to be installed locally.
11326

11427
To install a client certificate, see [Install a client certificate for Point-to-Site connections](point-to-site-how-to-vpn-client-install-azure-cert.md).
11528

116-
## <a name="install"></a>6. Continue with the P2S configuration steps
29+
## Next steps
11730

11831
Continue with your Point-to-Site configuration.
11932

120-
* For **Resource Manager** deployment model steps, see [Configure P2S using native Azure certificate authentication](vpn-gateway-howto-point-to-site-resource-manager-portal.md).
121-
* For **classic** deployment model steps, see [Configure a Point-to-Site VPN connection to a VNet (classic)](vpn-gateway-howto-point-to-site-classic-azure-portal.md).
122-
* For P2S troubleshooting information, see [Troubleshooting Azure point-to-site connections](vpn-gateway-troubleshoot-vpn-point-to-site-connection-problems.md).
33+
* For **Resource Manager** deployment model steps, see [Configure P2S using native Azure certificate authentication](vpn-gateway-howto-point-to-site-resource-manager-portal.md).
34+
* For **classic** deployment model steps, see [Configure a Point-to-Site VPN connection to a VNet (classic)](vpn-gateway-howto-point-to-site-classic-azure-portal.md).

‎includes/vpn-gateway-generate-export-certificates-include.md

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
---
2+
title: include file
3+
description: include file
4+
services: vpn-gateway
5+
author: cherylmc
6+
ms.service: vpn-gateway
7+
ms.topic: include
8+
ms.date: 10/10/2019
9+
ms.author: cherylmc
10+
ms.custom: include file
11+
---
12+
13+
## <a name="rootcert"></a>Create a self-signed root certificate
14+
15+
Use the New-SelfSignedCertificate cmdlet to create a self-signed root certificate. For additional parameter information, see [New-SelfSignedCertificate](https://technet.microsoft.com/itpro/powershell/windows/pkiclient/new-selfsignedcertificate).
16+
17+
1. From a computer running Windows 10 or Windows Server 2016, open a Windows PowerShell console with elevated privileges. These examples do not work in the Azure Cloud Shell "Try It". You must run these examples locally.
18+
2. Use the following example to create the self-signed root certificate. The following example creates a self-signed root certificate named 'P2SRootCert' that is automatically installed in 'Certificates-Current User\Personal\Certificates'. You can view the certificate by opening *certmgr.msc*, or *Manage User Certificates*.
19+
20+
```powershell
21+
$cert = New-SelfSignedCertificate -Type Custom -KeySpec Signature `
22+
-Subject "CN=P2SRootCert" -KeyExportPolicy Exportable `
23+
-HashAlgorithm sha256 -KeyLength 2048 `
24+
-CertStoreLocation "Cert:\CurrentUser\My" -KeyUsageProperty Sign -KeyUsage CertSign
25+
```
26+
27+
## <a name="clientcert"></a>Generate a client certificate
28+
29+
Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You generate a client certificate from the self-signed root certificate, and then export and install the client certificate. If the client certificate is not installed, authentication fails.
30+
31+
The following steps walk you through generating a client certificate from a self-signed root certificate. You may generate multiple client certificates from the same root certificate. When you generate client certificates using the steps below, the client certificate is automatically installed on the computer that you used to generate the certificate. If you want to install a client certificate on another client computer, you can export the certificate.
32+
33+
The examples use the New-SelfSignedCertificate cmdlet to generate a client certificate that expires in one year. For additional parameter information, such as setting a different expiration value for the client certificate, see [New-SelfSignedCertificate](https://technet.microsoft.com/itpro/powershell/windows/pkiclient/new-selfsignedcertificate).
34+
35+
### Example 1
36+
37+
Use this example if you have not closed your PowerShell console after creating the self-signed root certificate. This example continues from the previous section and uses the declared '$cert' variable. If you closed the PowerShell console after creating the self-signed root certificate, or are creating additional client certificates in a new PowerShell console session, use the steps in [Example 2](#ex2).
38+
39+
Modify and run the example to generate a client certificate. If you run the following example without modifying it, the result is a client certificate named 'P2SChildCert'. If you want to name the child certificate something else, modify the CN value. Do not change the TextExtension when running this example. The client certificate that you generate is automatically installed in 'Certificates - Current User\Personal\Certificates' on your computer.
40+
41+
```powershell
42+
New-SelfSignedCertificate -Type Custom -DnsName P2SChildCert -KeySpec Signature `
43+
-Subject "CN=P2SChildCert" -KeyExportPolicy Exportable `
44+
-HashAlgorithm sha256 -KeyLength 2048 `
45+
-CertStoreLocation "Cert:\CurrentUser\My" `
46+
-Signer $cert -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2")
47+
```
48+
49+
### <a name="ex2"></a>Example 2
50+
51+
If you are creating additional client certificates, or are not using the same PowerShell session that you used to create your self-signed root certificate, use the following steps:
52+
53+
1. Identify the self-signed root certificate that is installed on the computer. This cmdlet returns a list of certificates that are installed on your computer.
54+
55+
```powershell
56+
Get-ChildItem -Path “Cert:\CurrentUser\My”
57+
```
58+
2. Locate the subject name from the returned list, then copy the thumbprint that is located next to it to a text file. In the following example, there are two certificates. The CN name is the name of the self-signed root certificate from which you want to generate a child certificate. In this case, 'P2SRootCert'.
59+
60+
```
61+
Thumbprint Subject
62+
63+
AED812AD883826FF76B4D1D5A77B3C08EFA79F3F CN=P2SChildCert4
64+
7181AA8C1B4D34EEDB2F3D3BEC5839F3FE52D655 CN=P2SRootCert
65+
```
66+
3. Declare a variable for the root certificate using the thumbprint from the previous step. Replace THUMBPRINT with the thumbprint of the root certificate from which you want to generate a child certificate.
67+
68+
```powershell
69+
$cert = Get-ChildItem -Path "Cert:\CurrentUser\My\THUMBPRINT"
70+
```
71+
72+
For example, using the thumbprint for P2SRootCert in the previous step, the variable looks like this:
73+
74+
```powershell
75+
$cert = Get-ChildItem -Path "Cert:\CurrentUser\My\7181AA8C1B4D34EEDB2F3D3BEC5839F3FE52D655"
76+
```
77+
4. Modify and run the example to generate a client certificate. If you run the following example without modifying it, the result is a client certificate named 'P2SChildCert'. If you want to name the child certificate something else, modify the CN value. Do not change the TextExtension when running this example. The client certificate that you generate is automatically installed in 'Certificates - Current User\Personal\Certificates' on your computer.
78+
79+
```powershell
80+
New-SelfSignedCertificate -Type Custom -DnsName P2SChildCert -KeySpec Signature `
81+
-Subject "CN=P2SChildCert" -KeyExportPolicy Exportable `
82+
-HashAlgorithm sha256 -KeyLength 2048 `
83+
-CertStoreLocation "Cert:\CurrentUser\My" `
84+
-Signer $cert -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2")
85+
```
86+
87+
## <a name="cer"></a>Export the root certificate public key (.cer)
88+
89+
[!INCLUDE [Export public key](vpn-gateway-certificates-export-public-key-include.md)]
90+
91+
### Export the self-signed root certificate and private key to store it (optional)
92+
93+
You may want to export the self-signed root certificate and store it safely as backup. If need be, you can later install it on another computer and generate more client certificates. To export the self-signed root certificate as a .pfx, select the root certificate and use the same steps as described in [Export a client certificate](#clientexport).
94+
95+
## <a name="clientexport"></a>Export the client certificate
96+
97+
[!INCLUDE [Export client certificate](vpn-gateway-certificates-export-client-cert-include.md)]

0 commit comments

Comments
 (0)