Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm currently writing a Powershell script and have run into a bit of a roadblock. Basically, the script requests, approves, and retrieves new certificates from our CA using certreq.exe and certutil.exe.

So far, I have the request and approval working fine, but as soon as I try to retrieve the newly-approved cert I get a 'directory name is invalid' referring to the CA. I'm using the exact same -config string for all the other commands, but it fails on the certreq.exe -retrieve call. If I remove it, it prompts me to select the correct CA out of a list, of which there is only the one. I'd very much like to avoid that, as I'm trying to automate the renewal of 450+ certificates and having to sit here and click a button for each one will somewhat defeat the whole point.

Anyone have any ideas?


More info:

Powershell script flows as such:

  1. Create .inf file
  2. Run certreq.exe -new using the generated inf file to create a .req
  3. Run certreq.exe -submit with the generated .req
  4. The RequestID is captured from the -submit command and passed to certutil.exe -Resubmit to approve it
  5. Run certreq -retrieve with the captured RequestID, fails saying it cannot find the CA that was used in both the certreq -submit and certutil -resubmit commands.
share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.