IT Services Reference
Powered by

Certificate creation — recovered PowerShell example

In 

Review the certificate-naming, exportability and output fields used in a recovered PowerShell certificate-creation example. The upload guide it depends on is held, and the command fragments are not a complete app-registration procedure.

Captured sequence and missing handoff

  1. Run this code and keep the terminal open because you will need it.
  2. The source then refers to Upload your certificate. That guide is held; the handoff cannot be completed from this page alone.

Purpose of the naming and output fields

  • Identify the app associated with the certificate.
  • Identify whether the certificate is exportable.
  • Identify the device for a non-exportable certificate by adding its hostname to \$certName.
  • Display the information needed to
  1. upload the cert to the Entra App
  2. connect to the Entra App from powershell.

Non-Exportable: Useful for development, locks cert to a device. Exportable: Useful for Azure Scripts because you can't lock to a device.

{

#Non-Exportable: Useful for development, locks to a device. #Exportable: Useful for Azure Scripts because you can't lock to a device.

#STEP1 - Copy and pasting this code into Notepad or VS Code

#STEP 2 - Decide on Exportable or non exportable $Exportable=$false

#STEP 3 - Give the Certificate A Name

#Example for $NameFate = "PowerShell-SharepointAuditApp" $NameForCertificate = "Powershell <replace with name for your App>"

#STEP 4 - Paste everything including the { at the top into Terminal

#STEP 5 - Delete the { from the top of this script and press enter

#Builds the name for the certificate if($Exportable -eq $true){

$KeyExportPolicy = "Exportable"

certName = "(NameForCertificate)-($KeyExportPolicy)"

}else{

$KeyExportPolicy = "NonExportable"

certName = "(NameForCertificate)-(KeyExportPolicy)-($ENV:computername)"

}

#Subject used for the certificate

#Example output for $subjectForCertificate could be

#"CN=PowerShell App-Only-N9NXNZ00C301388"

$subjectForCertificate = "CN=$certName"

#Create Certificate and Save To Cert Store

$cert = New-SelfSignedCertificate -Subject "$subjectForCertificate" -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy $KeyExportPolicy -KeySpec Signature -KeyLength 2048 -KeyAlgorithm RSA -HashAlgorithm SHA256

#Export Path For certificate

$filePath = Join-Path $($ENV:OneDriveCommercial) $("Documents$($certname).cer")

#Export Certificate to $filePath

Export-Certificate -Cert $cert -FilePath "$filePath"

#See where the exported cert will be saved Write-Host "`r`nUpload this Cert File(.cer) To Upload To App" -ForegroundColor Cyan

Write-Host "$filePath`r`n"

Write-Host "Description for Cert in Azure App" -ForegroundColor Cyan

Write-Host "$certName`r`n"

Write-Host "Subject for Cert in MS Graph Connection" -ForegroundColor Cyan

Write-Host "$subjectForCertificate"

Write-Host "Thumbprint if using cert to Connecting to Exchange Online via Entra App"

$Thumbprint = $(Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object {$_.Subject -match $subjectForCertificate}).Thumbprint

Write-Host "$Thumbprint"