AD CS Configuration Using Install-AdcsCertificationAuthority Cmdlet

Question

I am trying to configure a subordinate CA using a .PFX file with PowerShell. I am using the below parameters:

$params = @{
    CAType = "EnterpriseSubordinateCA"
    Credential = $credential
    CertFile = C:\PKI\MyCert.pfx
    CertFilePassword = $password
}
Install-AdcsCertificationAuthority @params -Whatif

What if: Certification authority will be installed with the following properties:
CAType: EnterpriseSubordinateCA
...
...
CryptoProviderName: RSA#Microsoft Software Key Storage Provider
HashAlgorithmName: SHA1

Even though MyCert.pfx file is SHA256, the cmdlet -Whatif shows SHA1.

If I use server manager to configure AD-CS and import the .PFX file, it correctly installs using SHA256

Am I missing something? Or is the cmdlet bugged.

Answer 1

You need to add -HashAlgorithmName sha256 as a parameter to to your cmdlet (or in your case, HashAlgorithmName = "sha256" to your splatting variable) to configure the algorithm used to sign certificates. That algorithm is not necessarily the same as that of the CA certificate signing it.