Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently writing a Powershell script and have run into a bit of a roadblock. Basically, the script requests, approves, and retrieves new certificates from our CA using certreq.exe and certutil.exe.

So far, I have the request and approval working fine, but as soon as I try to retrieve the newly-approved cert I get a 'directory name is invalid' referring to the CA. I'm using the exact same -config string for all the other commands, but it fails on the certreq.exe -retrieve call. If I remove it, it prompts me to select the correct CA out of a list, of which there is only the one. I'd very much like to avoid that, as I'm trying to automate the renewal of 450+ certificates and having to sit here and click a button for each one will somewhat defeat the whole point.

Anyone have any ideas?


More info:

Powershell script flows as such:

  1. Create .inf file
  2. Run certreq.exe -new using the generated inf file to create a .req
  3. Run certreq.exe -submit with the generated .req
  4. The RequestID is captured from the -submit command and passed to certutil.exe -Resubmit to approve it
  5. Run certreq -retrieve with the captured RequestID, fails saying it cannot find the CA that was used in both the certreq -submit and certutil -resubmit commands.
share|improve this question

Try using the -config parameter. Please check out the TechNet page for more details on the options included in certreq.exe and certutil.exe.

I know I am too late to answer this, but hopefully this will help someone else.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.