I'm currently writing a Powershell script and have run into a bit of a roadblock. Basically, the script requests, approves, and retrieves new certificates from our CA using certreq.exe and certutil.exe.

So far, I have the request and approval working fine, but as soon as I try to retrieve the newly-approved cert I get a 'directory name is invalid' referring to the CA. I'm using the exact same -config string for all the other commands, but it fails on the certreq.exe -retrieve call. If I remove it, it prompts me to select the correct CA out of a list, of which there is only the one. I'd very much like to avoid that, as I'm trying to automate the renewal of 450+ certificates and having to sit here and click a button for each one will somewhat defeat the whole point.

Anyone have any ideas?


More info:

Powershell script flows as such:

  1. Create .inf file
  2. Run certreq.exe -new using the generated inf file to create a .req
  3. Run certreq.exe -submit with the generated .req
  4. The RequestID is captured from the -submit command and passed to certutil.exe -Resubmit to approve it
  5. Run certreq -retrieve with the captured RequestID, fails saying it cannot find the CA that was used in both the certreq -submit and certutil -resubmit commands.

This works for me in PowerShell scripts:

invoke-expression -command "certreq -config `"$OnlineCA`" -Retrieve $RequestId `"$CertificateFileName`" "

Try using the -config parameter. Please check out the TechNet page for more details on the options included in certreq.exe and certutil.exe.


I know I am too late to answer this, but hopefully this will help someone else.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.