How to Create a Self-Signed Certificate Using PowerShell?

In this tutorial, I will explain how to create a self-signed certificate using PowerShell. As a system administrator in the USA, I recently faced a situation where I needed to set up a secure testing environment for a web application. Creating a self-signed certificate was the quickest and most efficient solution. In this tutorial, I’ll walk you through the process step-by-step, creating a self-signed certificate using PowerShell using various examples.

Table of Contents

What is a Self-Signed Certificate?

A self-signed certificate is a digital certificate that is signed by the same entity whose identity it certifies, rather than by a trusted third-party certificate authority (CA). Self-signed certificates are commonly used for testing purposes, internal networks, or when a CA-issued certificate is not required.

PowerShell provides a simple and efficient way to generate self-signed certificates using the New-SelfSignedCertificate cmdlet. This built-in cmdlet allows you to create certificates without the need for additional tools.

Create a Self-Signed Certificate Using PowerShell

Follow the below steps to create a self-signed certificate using PowerShell.

Step 1: Open PowerShell as Administrator

To create a self-signed certificate, you’ll need to run PowerShell with administrator privileges. Right-click on the PowerShell icon and select “Run as Administrator.”

Step 2: Use the New-SelfSignedCertificate Cmdlet

The New-SelfSignedCertificate cmdlet is the primary tool for creating self-signed certificates in PowerShell. Here’s an example command:

New-SelfSignedCertificate -DnsName "www.example.com", "example.com" -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(1)

Let’s break down the parameters used in this command:

-DnsName: Specifies the subject alternative names (SANs) for the certificate. In this example, we’re using “www.example.com” and “example.com”.
-CertStoreLocation: Specifies the certificate store where the new certificate will be placed. “cert:\LocalMachine\My” refers to the Personal store on the local machine.
-NotAfter: Sets the expiration date for the certificate. In this example, the certificate will expire one year from the current date.

Check out Disable Local User Computer Accounts Using PowerShell

Step 3: Verify the Certificate

After running the command, you can verify that the certificate was created by using the Get-ChildItem cmdlet:

Get-ChildItem -Path "cert:\LocalMachine\My"

This will display a list of certificates in the Personal store, including the newly created self-signed certificate.

Step 4: Export the Certificate (Optional)

If you need to use the self-signed certificate on another machine or for a specific application, you can export it using the Export-Certificate cmdlet:

$cert = Get-ChildItem -Path "cert:\LocalMachine\My" | Where-Object {$_.Subject -eq "CN=www.example.com"}
Export-Certificate -Cert $cert -FilePath "C:\Certs\example.cer" -Type CERT

This command first retrieves the certificate with the subject “CN=www.example.com” and then exports it as a .cer file to the specified file path.

Here is the complete PowerShell script, I executed the above script using VS code, and you can see the exact output in the screenshot below:

New-SelfSignedCertificate -DnsName "www.example.com", "example.com" -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(1)
Get-ChildItem -Path "cert:\LocalMachine\My"
$cert = Get-ChildItem -Path "cert:\LocalMachine\My" | Where-Object {$_.Subject -eq "CN=www.example.com"}
Export-Certificate -Cert $cert -FilePath "C:\Certs\example.cer" -Type CERT

Create a Self-Signed Certificate Using PowerShell

Check out Disable Windows Firewall Using PowerShell

Using the Self-Signed Certificate for Testing

Once you have created the self-signed certificate, you can use it for testing purposes in your web application or other secure environments. For example, you can bind the certificate to an IIS website or use it to encrypt communication between servers.

Keep in mind that self-signed certificates are not trusted by default and may generate security warnings in web browsers. However, for testing and internal use, they provide a quick and easy way to set up secure connections.

Best Practices for Self-Signed Certificates

While self-signed certificates are useful for testing and internal environments, there are some best practices to keep in mind:

Don’t use self-signed certificates for public-facing websites: Self-signed certificates are not trusted by web browsers and will generate security warnings for users. Always use CA-issued certificates for public websites.
Set an appropriate expiration date: When creating a self-signed certificate, make sure to set a reasonable expiration date. Certificates that expire too quickly can cause unnecessary disruptions, while certificates with overly long lifespans can pose security risks.
Securely store and manage private keys: When exporting self-signed certificates, ensure that the private key is kept secure. Unauthorized access to the private key can compromise the security of your testing environment.

Conclusion

In this tutorial, I have explained how to create a self-signed certificate using PowerShell. You can quickly generate and manage self-signed certificates for your organization’s needs by following the steps.

Remember, while self-signed certificates have their place in testing and internal environments, always use trusted CA-issued certificates for public-facing websites and production environments to ensure the security and trust of your users.