时间戳

首页 > 解决方案 > Powershell - 代表注册 SSL 证书

powershell - Powershell - 代表注册 SSL 证书

问题描述

我创建了注册代理证书，通过 GUI 我可以为另一个用户安装证书。现在，我想使用 Powershell 自动执行此过程。

在我的本地证书存储中安装了注册代理证书（模板名称：注册代理）以及我想向其他用户颁发的证书（模板名称：GP）

$PKCS10 = New-Object -ComObject X509Enrollment.CX509CertificateRequestPkcs10
# cert template name i want to issue to user
$PKCS10.InitializeFromTemplateName(0x1,"GP")
$PKCS10.Encode()
$pkcs7 = New-Object -ComObject X509enrollment.CX509CertificateRequestPkcs7
$pkcs7.InitializeFromInnerRequest($pkcs10)
$pkcs7.RequesterName = "domain\some.user"
$signer = New-Object -ComObject X509Enrollment.CSignerCertificate
# bellow is thumbprint of certificate i want to issue (GP)
$signer.Initialize(0,0,0xc,"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx")
$pkcs7.SignerCertificate = $signer
$Request = New-Object -ComObject X509Enrollment.CX509Enrollment
$Request.InitializeFromRequest($pkcs7)
$Request.Enroll()

最后一行失败并出现错误

CertEnroll::CX509Enrollment::Enroll: Error Verifying Request Signature
or Signing Certificate  The certificate is not valid for the requested usage. 
0x800b0110 (-2146762480 CERT_E_WRONG_USAGE)

标签： powershellssl-certificateca

解决方案

已解决，必须指定注册代理指纹

推荐阅读