certreq

The certreq command can be used to request certificates from a certification authority (CA), to retrieve a response to a previous request from a CA, to create a new request from an .inf file, to accept and install a response to a request, to construct a cross-certification or qualified subordination request from an existing CA certificate or request, and to sign a cross-certification or qualified subordination request.

Syntax

certreq [-submit] [options] [requestfilein [certfileout [certchainfileout [fullresponsefileOut]]]]
certreq -retrieve [options] requestid [certfileout [certchainfileout [fullresponsefileOut]]]
certreq -new [options] [policyfilein [requestfileout]]
certreq -accept [options] [certchainfilein | fullresponsefilein | certfilein]
certreq -sign [options] [requestfilein [requestfileout]]
certreq –enroll [options] templatename
certreq –enroll –cert certId [options] renew [reusekeys]

Parameters

Examples

certreq -submit

To submit a basic certificate request:

certreq –submit certrequest.req certnew.cer certnew.pfx

Remarks

• This is the default certreq.exe parameter. If no option is specified at the command-line prompt, certreq.exe attempts to submit a certificate request to a certificate authority. You must specify a certificate request file when using the –submit option. If this parameter is omitted, a common File Open window appears, letting you select the appropriate certificate request file.

• To request a certificate by specifying the SAN attribute, see the How to use the certreq.exe utility to create and submit a certificate request section of Microsoft Knowledge Base article 931351 How to add a Subject Alternative Name to a secure LDAP certificate.

certreq -retrieve

To retrieve certificate ID 20 and to create a certificate file (.cer), named MyCertificate:

certreq -retrieve 20 MyCertificate.cer

Remarks

• Use certreq -retrieve requestid to retrieve the certificate after the certificate authority has issued it. The requestid PKC can be a decimal or hex with 0x prefix and it can be a certificate serial number with no 0x prefix. You can also use it to retrieve any certificate that has ever been issued by the certificate authority, including revoked or expired certificates, without considering if the certificate's request was ever in the pending state.

• If you submit a request to the certificate authority, the policy module of the certificate authority might leave the request in a pending state and return the requestid to the certreq caller for display. Eventually, the certificate authority's administrator issues the certificate or deny the request.

certreq -new

To create a new request:

[newrequest]
; At least one value must be set in this section
subject = CN=W2K8-BO-DC.contoso2.com

The following are some of the possible sections that may be added to the INF file:

[newrequest]

This area of the INF file is mandatory for any new certificate request templates, and must include at least one parameter with a value.

¹Parameter to the left of the equal sign (=)

²Parameter to the right of the equal sign (=)

[Extensions]

This section is optional.

Example

To create a policy file (.inf) in Notepad and save it as requestconfig.inf:

[NewRequest]
Subject = CN=<FQDN of computer you are creating the certificate>
Exportable = TRUE
KeyLength = 2048
KeySpec = 1
KeyUsage = 0xf0
MachineKeySet = TRUE
[RequestAttributes]
CertificateTemplate=WebServer
[Extensions]
OID = 1.3.6.1.5.5.7.3.1
OID = 1.3.6.1.5.5.7.3.2

On the computer for which you're requesting a certificate:

certreq –new requestconfig.inf certrequest.req

To use the [Strings] section syntax for OIDs and other difficult to interpret data. The new {text} syntax example for EKU extension, which uses a comma separated list of OIDs:

[Version]
Signature=$Windows NT$

[Strings]
szOID_ENHANCED_KEY_USAGE = 2.5.29.37
szOID_PKIX_KP_SERVER_AUTH = 1.3.6.1.5.5.7.3.1
szOID_PKIX_KP_CLIENT_AUTH = 1.3.6.1.5.5.7.3.2

[NewRequest]
Subject = CN=TestSelfSignedCert
Requesttype = Cert

[Extensions]
%szOID_ENHANCED_KEY_USAGE%={text}%szOID_PKIX_KP_SERVER_AUTH%,
_continue_ = %szOID_PKIX_KP_CLIENT_AUTH%

To specify a Subject Alternate Name (SAN), add it in the [Extensions] section of your INF. For example:

[Version]
Signature=$Windows NT$
 
[Strings]
szOID_ENHANCED_KEY_USAGE = 2.5.29.37
szOID_PKIX_KP_SERVER_AUTH = 1.3.6.1.5.5.7.3.1
szOID_PKIX_KP_CLIENT_AUTH = 1.3.6.1.5.5.7.3.2

[NewRequest]
Subject = CN=TestSelfSignedCert
Requesttype = Cert

[Extensions]
2.5.29.17 = "{text}"
_continue_ = "DNS=example.com"
_continue_ = "DNS=www.example.com"
_continue_ = "IP Address=192.168.1.1"

In this example, 2.5.29.17 is the OID defining the SAN. To specify multiple SANs, the _continue_ extension OID is used, which lets you separate and specify each SAN extension.

certreq -accept

The –accept parameter links the previously generated private key with the issued certificate and removes the pending certificate request from the system where the certificate is requested (if there's a matching request).

To manually accept a certificate:

certreq -accept certnew.cer

certreq -policy

The policy.inf file is a configuration file that defines the constraints applied to a CA certification, when a qualified subordination is defined.

To build a cross certificate request:

certreq -policy certsrv.req policy.inf newcertsrv.req

Using certreq -policy without any other parameter opens a dialog window, allowing you to select the requested file (.req, .cmc, .txt, .der, .cer or .crt). After you select the requested file and click Open, another dialog window opens, allowing you to select the policy.inf file.

Examples

Find an example of the policy.inf file in the CAPolicy.inf Syntax.

certreq -sign

To create a new certificate request, sign it, and to submit it:

certreq -new policyfile.inf myrequest.req
certreq -sign myrequest.req myrequest.req
certreq -submit myrequest_sign.req myrequest_cert.cer

Remarks

• Using certreq -sign without any other parameter it opens a dialog window so you can select the requested file (req, cmc, txt, der, cer or crt).

• Signing the qualified subordination request may require Enterprise Administrator credentials. This is a best practice for issuing signing certificates for qualified subordination.

• The certificate used to sign the qualified subordination request uses the qualified subordination template. Enterprise Administrators have to sign the request or grant user permissions to the individuals signing the certificate.

• You might be required to have additional personnel sign the CMC request after you. This depends on the assurance level associated with the qualified subordination.

• If the parent CA of the qualified subordinate CA you're installing is offline, you must obtain the CA certificate for the qualified subordinate CA from the offline parent. If the parent CA is online, specify the CA certificate for the qualified subordinate CA during the Certificate Services Installation wizard.

certreq -enroll

You can use this comment to enroll or renew your certificates.

Examples

To enroll a certificate, using the WebServer template, and by selecting the policy server using U/I:

certreq -enroll –machine –policyserver * WebServer

To renew a certificate using a serial number:

certreq –enroll -machine –cert 61 2d 3c fe 00 00 00 00 00 05 renew

You can only renew valid certificates. Expired certificates can't be renewed and must be replaced with a new certificate.

Options

Formats

Additional Resources

The following articles contain examples of certreq usage:

• How to add a subject alternative name to a secure LDAP certificate

• Test Lab Guide: Deploying an AD CS Two-Tier PKI Hierarchy

• Appendix 3: Certreq.exe Syntax

• How to create a web server SSL certificate manually

• Certificate Enrollment for System Center Operations Manager Agent

• Active Directory Certificate Services Overview

• How to enable LDAP over SSL with a third-party certification authority