# Certificate creation — recovered PowerShell example

Review the certificate-naming, exportability and output fields used in a recovered PowerShell certificate-creation example. The upload guide it depends on is held, and the command fragments are not a complete app-registration procedure.

!!!warning Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
!!!

## Captured sequence and missing handoff

1.  Run this code and keep the terminal open because you will need it.
2.  The source then refers to [Upload your certificate](../../review/Review-status.md#source-93f1ad0c48054992). That guide is held; the handoff cannot be completed from this page alone.

## Purpose of the naming and output fields

- Identify the app associated with the certificate.
- Identify whether the certificate is exportable.
- Identify the device for a non-exportable certificate by adding its hostname to `\$certName`.
- Display the information needed to

1.  upload the cert to the Entra App
2.  connect to the Entra App from powershell.

**Non-Exportable:** Useful for development, locks cert to a device. **Exportable:** Useful for Azure Scripts because you can't lock to a device.

{

\#Non-Exportable: Useful for development, locks to a device. \#Exportable: Useful for Azure Scripts because you can't lock to a device.

\#STEP1 - Copy and pasting this code into Notepad or VS Code

\#STEP 2 - Decide on Exportable or non exportable $Exportable=$false

\#STEP 3 - Give the Certificate A Name

\#Example for \$NameFate = "PowerShell-SharepointAuditApp" \$NameForCertificate = "Powershell \<replace with name for your App\>"

\#STEP 4 - Paste everything including the { at the top into Terminal

\#STEP 5 - Delete the { from the top of this script and press enter

\#Builds the name for the certificate if(\$Exportable -eq \$true){

``` powershell
$KeyExportPolicy = "Exportable"
```

$certName = "$($NameForCertificate)-$(\$KeyExportPolicy)"

}else{

``` powershell
$KeyExportPolicy = "NonExportable"
```

$certName = "$($NameForCertificate)-$($KeyExportPolicy)-$(\$ENV:computername)"

}

\#Subject used for the certificate

\#Example output for \$subjectForCertificate could be

\#"CN=PowerShell App-Only-N9NXNZ00C301388"

$subjectForCertificate = "CN=$certName"

\#Create Certificate and Save To Cert Store

$cert = New-SelfSignedCertificate -Subject "$subjectForCertificate" -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy \$KeyExportPolicy -KeySpec Signature -KeyLength 2048 -KeyAlgorithm RSA -HashAlgorithm SHA256

\#Export Path For certificate

\$filePath = Join-Path $($ENV:OneDriveCommercial) $("Documents\$($certname).cer")

\#Export Certificate to \$filePath

Export-Certificate -Cert $cert -FilePath "$filePath"

\#See where the exported cert will be saved Write-Host "\`r\`nUpload this Cert File(.cer) To Upload To App" -ForegroundColor Cyan

Write-Host "\$filePath\`r\`n"

Write-Host "Description for Cert in Azure App" -ForegroundColor Cyan

Write-Host "\$certName\`r\`n"

Write-Host "Subject for Cert in MS Graph Connection" -ForegroundColor Cyan

Write-Host "\$subjectForCertificate"

Write-Host "Thumbprint if using cert to Connecting to Exchange Online via Entra App"

``` powershell
$Thumbprint = $(Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object {$_.Subject -match $subjectForCertificate}).Thumbprint
```

Write-Host "\$Thumbprint"

## Related guidance

- [Topic overview](Introduction.md)
- [Source review status](../../review/Review-status.md)