The certreq command in Windows

Certreq can be used to request a certificate from a certificate authority (CA), to receive a response to a previous request from a CA, create a new request from the .inf file , accept and install set a response to the request, build a cross-authorization request, certificate of eligibility from the certificate or request an existing CA and sign a cross-qualification or eligibility request.

Warning

Previous versions of certreq may not provide all the options described in this document. You can see all the options that a specific version of certreq provides by running the commands shown in the Syntax Notation section below.

The verbs are used with the certreq command

The following table describes the verbs that can be used with the certreq command :

Verb-Submit Description Submit a request to CA. For more information, see Certreq -submit . -retrieve RequestID Retrieve feedback for a previous request from CA. For more information, see Certreq -retrieve. -New Create a new request from the .inf file . For more information, see Certreq -new section . -Accept Accept and install response for certificate request. For more information, see Certreq -accept. -Policy Set policies for a request. For more information, see the Certreq -policy section . -Sign a signed sub-request or cross certification. For more information, see Certreq -ign. -Enroll Register or renew the certificate. For more information, see Certreq -enroll. -? Displays the list of syntax, options and descriptions of the certreq command . -? Show help for the specified verb. -v -? Displays a detailed list for the syntax, options and certreq command descriptions .

Syntax notation

For the basic command line syntax, run:

 certreq -? 

For the syntax to use certutil with a specific verb, run:

 certreq -? 

To send all certutil syntax to a text file, run the following commands:

 certreq -v -? > certreqhelp.txt 

 notepad certreqhelp.txt 

The following table describes the symbol used to indicate the command line syntax.

Symbols Description Description Text without square brackets or curly brackets Items you must enter as shown text="" in="" on="" swa="" get="" mut="" Placeholder where you must provide the value [Text inside square brackets] Optional items {Text within curly braces} Select one of the required items Vertical bar (|) Separator for category items except for each other (choose one of the items) Ellipsis (.) Items can be repeated

Certreq -submit

This is the certreq.exe parameter by default, if no options are specified at the command prompt, certreq.exe will try to send a certificate request to CA.

 CertReq [-Submit] [Options] [RequestFileIn [CertFileOut [CertChainFileOut [FullResponseFileOut]]]] 

You must specify the certificate request file when using the -submit option . If this parameter is omitted, a File Open window will be displayed. This is where you can select the appropriate certificate request file.

You can use these examples as a starting point to create your certificate request. To submit a simple certificate request, use the example below:

 certreq –submit certRequest.req certnew.cer certnew.pfx 

Certreq -retrieve

 certreq -retrieve [Options] RequestId [CertFileOut [CertChainFileOut [FullResponseFileOut]]] 

1. If you do not specify a CAComputerName or CAName in -config , a CAComputerNameCANamea dialog box will appear and display a list of all available CAs.
2. If you use -config instead of -config CAComputerNameCAName, the operation is handled by the default CA.
3. You can use the certreq -retrieve RequestID to get the certificate after the CA has actually released it. RequestIDPKC can be a decimal or hexadecimal with the 0x prefix and it can be a certificate serial number without a 0x prefix . You can also use it to retrieve any CA issued certificates, including revoked or expired certificates, regardless of whether the certificate's request is in a pending state.
4. If you send a request to the CA, the CA policy module can leave a request in a pending state and return the RequestID to the person calling Certreq . Finally, the CA administrator will issue a certificate or deny the request.

The following command retrieves the id 20 certificate and creates a certificate file (.cer):

 certreq -retrieve 20 MyCertificate.cer 

Certreq -new

 certreq -new [Options] [PolicyFileIn [RequestFileOut]] 

Because INF files allow rich set of parameters and options, it is difficult to determine the default template that administrators should use for all purposes. Therefore, this section describes all the options that allow you to create an INF file that fits your specific needs. The following keywords are used to describe the INF file structure.

1. A section is an area in the INF file that includes a group of logical keys. The section always appears in brackets in the INF file.
2. Key is the parameter to the left of the equals sign.
3. Value is the parameter to the right of the equals sign.

For example, a minimal INF file will look like this:

 [NewRequest] ; At least one value must be set in this section Subject = "CN=W2K8-BO-DC.contoso2.com" 

The following are some sections that can be added to the INF file. This section is required for the INF file, which acts as a template for the new certificate request. This section requires at least one key of value:

 certutil -oid 1 | findstr pwszCNGAlgid | findstr /v CryptOIDInfo 

 certutil -oid 1 | findstr pwszCNGAlgid | findstr /v CryptOIDInfo 

 certutil -oid 2 | findstr pwszCNGAlgid 

This section is optional.

OID extension Definition Example2.5.29.17 2.5.29.17 = "{text}" continue continue = "UPN=User@Domain.com&" continue continue = "EMail=User@Domain.com&" continue continue = "DNS = host .domain.com & " continue continue =" DirectoryName = CN = Name, DC = Domain, DC = com & " continue continue =" URL = http:///host.domain.com/default.html& " continue continue =" IPAddress = 10.0 .0.1 & " continue continue =" RegisteredId = 1.2.3.4.5 & " continue continue =" 1.2.3.4.6.1 = {utf8} String & " continue continue =" 1.2.3.4.6.2 = {octet} AAECAwQFBgc = & " continue continue = "1.2.3.4.6.2 = {octet} {hex} 00 01 02 03 04 05 06 07 &" continue continue = "1.2.3.4.6.3 = {asn} BAgAAQIDBAUGBw == &" continue continue = "1.2.3.4.6.3 = {hex} 04 08 00 01 02 03 04 05 06 07 "2.5.29.37 2.5.29.37 =" {text} " continue continue =" 1.3.6.1.5.5.7. continue continue = "1.3.6.1.5.5.7.3 .1 "2.5.29.19" {text} ca = 0pathlength = 3 "Critical Critical = 2.5.29.19 KeySpec AT_NONE - 0
AT_SIGNATURE - 2
AT_KEYEXCHANGE - 1 RequestType PKCS10 - 1
PKCS7 - 2
CMC - 3
Cert - 4 KeyUsage CERT_DIGITAL_SIGNATURE_KEY_USAGE - 80 (128)
CERT_NON_REPUDIATION_KEY_USAGE - 40 (64)
CERT_KEY_ENCIPHERMENT_KEY_USAGE - 20 (32)
CERT_DATA_ENCIPHERMENT_KEY_USAGE - 10 (16)
CERT_KEY_AGREEMENT_KEY_USAGE - 8
CERT_KEY_CERT_SIGN_KEY_USAGE - 4
CERT_OFFLINE_CRL_SIGN_KEY_USAGE - 2
CERT_CRL_SIGN_KEY_USAGE - 2
CERT_ENCIPHER_ONLY_KEY_USAGE - 1
CERT_DECIPHER_ONLY_KEY_USAGE - 8000 (32768) KeyUsageProperty NCRYPT_ALLOW_DECRYPT_FLAG - 1
NCRYPT_ALLOW_SIGNING_FLAG - 2
NCRYPT_ALLOW_KEY_AGREEMENT_FLAG - 4
NCRYPT_ALLOW_ALL_USAGES - ffffff (16777215) KeyProtection NCRYPT_UI_NO_PROTECTION_FLAG - 0
NCRYPT_UI_PROTECT_KEY_FLAG - 1
NCRYPT_UI_FORCE_HIGH_PROTECTION_FLAG - 2 SubjectNameFlags template CT_FLAG_SUBJECT_REQUIRE_COMMON_NAME - 40000000 (1073741824)
CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH - 80000000 (2147483648)
CT_FLAG_SUBJECT_REQUIRE_DNS_AS_CN - 10000000 (268435456)
CT_FLAG_SUBJECT_REQUIRE_EMAIL - 20000000 (536870912)
CT_FLAG_OLD_CERT_SUPPLIES_SUBJECT_AND_ALT_NAME - 8
CT_FLAG_SUBJECT_ALT_REQUIRE_DIRECTORY_GUID - 1000000 (16777216)
CT_FLAG_SUBJECT_ALT_REQUIRE_DNS - 8000000 (134217728)
CT_FLAG_SUBJECT_ALT_REQUIRE_DOMAIN_DNS - 400000 (4194304)
CT_FLAG_SUBJECT_ALT_REQUIRE_EMAIL - 4000000 (67108864)
CT_FLAG_SUBJECT_ALT_REQUIRE_SPN - 800000 (8388608)
CT_FLAG_SUBJECT_ALT_REQUIRE_UPN - 2000000 (33554432) X500NameFlags CERT_NAME_STR_NONE - 0
CERT_OID_NAME_STR - 2
CERT_X500_NAME_STR - 3
CERT_NAME_STR_SEMICOLON_FLAG - 40000000 (1073741824)
CERT_NAME_STR_NO_PLUS_FLAG - 20000000 (536870912)
CERT_NAME_STR_NO_QUOTING_FLAG - 10000000 (268435456)
CERT_NAME_STR_CRLF_FLAG - 8000000 (134217728)
CERT_NAME_STR_COMMA_FLAG - 4000000 (67108864)
CERT_NAME_STR_REVERSE_FLAG - 2000000 (33554432)
CERT_NAME_STR_FORWARD_FLAG - 1000000 (16777216)
CERT_NAME_STR_DISABLE_IE4_UTF8_FLAG - 10000 (65536)
CERT_NAME_STR_ENABLE_T61_UNICODE_FLAG - 20000 (131072)
CERT_NAME_STR_ENABLE_UTF8_UNICODE_FLAG - 40000 (262144)
CERT_NAME_STR_FORCE_UTF8_DIR_STR_FLAG - 80000 (524288)
CERT_NAME_STR_DISABLE_UTF8_DIR_STR_FLAG - 100000 (1048576)
CERT_NAME_STR_ENABLE_PUNYCODE_FLAG - 200000 (2097152)

Note:

SubjectNameFlags allow INF file to specify which Subject and SubjectAltName extension will be automatically filled by certreq based on the user or current machine properties: DNS name, UPN, etc. Using the word "template" means SubjectNameFlags used instead. This allows a single INF file to be used in many contexts, to create requirements that match each specific context.

X500NameFlags specifies flags that are passed directly to the CertStrToName API when the Subject INF keys are converted to the ASN.1 encoded Distinguished Name.

To request a certificate through the use of certreq, use the steps from the example below:

Warning

The content in this section is based on the default settings for Windows Server 2008 AD CS. For example, set the key length to 2048, select Microsoft Software Key Storage Provider as the CSP and use Secure Hash Algorithm 1 (SHA1). Please rate these options based on the requirements of your company's privacy policy.

To create a Policy File (.inf) and save the example below in Notepad as RequestConfig.inf:

 [NewRequest] Subject = "CN=" Exportable = TRUE KeyLength = 2048 KeySpec = 1 KeyUsage = 0xf0 MachineKeySet = TRUE [RequestAttributes] CertificateTemplate="WebServer" [Extensions] OID = 1.3.6.1.5.5.7.3.1 OID = 1.3.6.1.5.5.7.3.2 

On the computer on which you are requesting a certificate type, enter the following command:

 CertReq –New RequestConfig.inf CertRequest.req 

The following example illustrates the implementation of [Strings] section syntax for OIDs and other unexplained data. For example, the new {text} syntax for EKU extension, uses a comma-separated list of OIDs:

 [Version] Signature="$Windows NT$ [Strings] szOID_ENHANCED_KEY_USAGE = "2.5.29.37" szOID_PKIX_KP_SERVER_AUTH = "1.3.6.1.5.5.7.3.1" szOID_PKIX_KP_CLIENT_AUTH = "1.3.6.1.5.5.7.3.2" [NewRequest] Subject = "CN=TestSelfSignedCert" Requesttype = Cert [Extensions] %szOID_ENHANCED_KEY_USAGE%="{text}%szOID_PKIX_KP_SERVER_AUTH%," _continue_ = "%szOID_PKIX_KP_CLIENT_AUTH%" 

Certreq -accept

 CertReq -accept [Options] [CertChainFileIn | FullResponseFileIn | CertFileIn] 

The parameter –accept of the private key link created earlier with the certificate has been issued and removes the pending certificate request from the certificate request system (if required).

You can use this example to accept the certificate manually:

 certreq -accept certnew.cer 

Warning

The –accept parameter, the -user and -machine options indicate whether the cert is installed in the user or machine context. If there are special requirements in both contexts that match the currently installed public key, these options are not necessary. If there are no special requirements, then one of these requirements must be specified.

Certreq -policy

 certreq -policy [-attrib AttributeString] [-binary] [-cert CertID] [RequestFileIn [PolicyFileIn [RequestFileOut [PKCS10FileOut]]]] 

1. The configuration file defines the constraints that are applied to the CA certificate when the qualifying clause is defined as Policy.inf.
2. If you type certreq -policy without any additional parameters, it will open a dialog window so you can select the required file (req, cmc, txt, der, cer or crt). When you select the required file and press the Open button , another dialog window will open to select the INF file.

You can use this example to create a cross-certificate request:

 certreq -policy Certsrv.req Policy.inf newcertsrv.req 

Certreq -sign

 certreq -sign [Options] [RequestFileIn [RequestFileOut]] 

1. If you type certreq -ign without any additional parameters, it will open a dialog window so you can select the required file (req, cmc, txt, der, cer or crt).
2. Signing an eligible sub-request may require a login for the Enterprise Administrator. This is the best way to get a qualified secondary certificate.
3. The certificate used to sign a sub-request is created using a qualified sub-template. Enterprise administrators will have to sign a request or grant user rights to individuals who will sign the certificate.
4. When you sign a CMC request, you need to have multiple employees sign this request, depending on the level of assurance associated with the eligibility sub-request.
5. If the secondary CA CA qualifies you to install as offline, you must have a CA certificate for the eligible secondary CA from the offline root CA. If the root CA is online, specify the CA certificate for the eligible secondary CA in the Certificate Services Installation Wizard.

The following command sequence will show how to create a new certificate request, sign it and submit it:

 certreq -new policyfile.inf MyRequest.req certreq -sign MyRequest.req MyRequest_Sign.req certreq -submit MyRequest_Sign.req MyRequest_cert.cer 

Certreq -enroll

To register for a certificate:

 certreq –enroll [Options] TemplateName 

To renew an existing certificate:

 certreq –enroll –cert CertId [Options] Renew [ReuseKeys] 

You can only renew a valid certificate on time. Expired certificates cannot be renewed and must be replaced with a new certificate.

Here is an example of certificate renewal with its serial number:

 certreq –enroll -machine –cert "61 2d 3c fe 00 00 00 00 00 05" Renew 

Below is an example of registering a certificate template called WebServer using an asterisk (*) to select a policy server via U / I:

 certreq -enroll –machine –policyserver * "WebServer" 

Options

Option Description-any Force ICertRequest :: Submit to specify the encoding type. -attrib Specifies a pair of Name and Value strings, separated by colons.
Separate pairs of Name and Value strings with n (for example, Name1: Value1nName2: Value2). -binary Format the output file in binary instead of base64-encoded. -PolicyServer "ldap:"
Insert a unique URI or ID for the computer running the Certificate Enrollment Policy Web Service.
To determine that you want to use the required file by browsing, simply use the minus sign ( - ) for. -config Processing works by using the CA specified in the configuration string, is CAHostNameCAName. For https connections, specify the registered server URI. For local CA machines, use a minus sign (-). -Anonymous Use anonymous login information for Certificate Enrollment Web Services. -Kerberos Use Kerberos (domain) login information for Certificate Enrollment Web Services. -ClientCertificate You can replace with the thumbprint of certificate, CN, EKU, template, email, UPN and new syntax name = value. -UserName Used with Certificate Enrollment Web Services. You can replace it with the SAM name or domainuser name. This option is used with the -p parameter . -p Used with Certificate Enrollment Web Services. Replace with the actual user's password. This option is used with the option - UserName. -user Configures the user context for a new certificate request or specifies a certificate acceptance context. This is the default context, if there is not specified in INF or template. -machine Configure new certificate request or specify certificate acceptance context for machine context. For new requirements, it must match MachineKeyset's INF key and template context. If this option is not specified and the template does not have context, then the default is the user's context. -crl Include certificate revocation lists (CRL) in the output of the PKCS # 7 file specified by CertChainFileOut or base64 encoded file specified by RequestFileOut. -rpc Instructions for Active Directory Certificate Services (AD CS) to use a remote procedure server connection instead of Distributed COM. -AdminForceMachine Use the Key Service or alternative option to send a request from the local system context. The user who calls this option requires to be a local administrator. -RenewOnBehalfOf Send the renewal on behalf of the entity identified in the certificate. This option sets CR_IN_ROBO when calling ICertRequest :: Submit -f Force existing files to be overwritten. This also ignores the cached templates and policies. -q Use silent mode; Prevent all interaction reminders. -Unicode Writes Unicode output when standard output is redirected or leads to another command, useful when called from Windows PowerShell scripts). -UnicodeText Send Unicode output when writing base64 encoded data blocks to files.

Formats

Format DescriptionRequestFileIn Base64 encoded or binary input file name: Request for PKCS # 10 certificate, request for CMS certificate, request for renewal of PKCS # 7 certificate, X.509 certificate cross-validation, or request request a certificate of KeyGen tag format. RequestFileOut Base64 encoded output file name. CertFileOut The X-509 file name is Base64 encoded. PKCS10FileOut Only use Certreq -policy. The output file name of PKCS10 is encoded as Base64. CertChainFileOut The PKCS # 7 filename is Base64 encrypted. FullResponseFileOut The full response file name is Base64 encoded. PolicyFileIn Only use Certreq -policy. The INF file contains the text representation of the extensions used to meet the eligibility requirements.

See more:

1. Diskshadow command in Windows
2. Diskcopy command in Windows
3. Diskcomp command in Windows

Lesley Montoya

Update 26 May 2019