I have about 100 CSR to sign on a windows PKI. I would like to know if it's possible to batch submit, issue and export these CSRs via batch or powershell script, maybe using cert util, and how to do it.

My searches haven't come up with anything but I still think this should be possible to do. Any help would be greatly appreciated.



I use command line tools on a standalone Windows 2003 CA, but I'm pretty sure they work the same way on newer versions as well.

To submit a request

certreq.exe -config .\MyCA -submit myhost1.req

This returns something like this:

RequestId: 555
Certificate request is pending: Taken Under Submission (0)

You can then issue the request:

certutil.exe -resubmit 555

and export it into a file:

certreq.exe -config .\MyCA -Retrieve 555 myhost1.cer

So with this knowledge and 100 request files in a directory you can use PowerShell:

  • Loop through all the files and execute the three commands for each file
  • You need to parse the output of the certreq submit command to get the request id you need in the later two steps.

-config .\myCA is to specify the CA to use, in this case one with the name 'myCA' on the local machine.

If you already have the requests in the system, you need to loop through all the pending ones and then run the last two steps against each one.


I found this question while tring to do something similar; I had a bunch of Base64 format CSRs generated by HP iLO devices and wanted to sign them all using our AD Certificate Services Enterprise CA.

I eventually managed to do it with this command:

certreq -config "caserver01.mydomain.com\Name of My CA" -attrib "CertificateTemplate:CNOfMyCertificateTemplate" -submit c:\myCSR.csr c:\pathToSaveCertificate.cer


  • You need to specify the CN of the certificate template not the display name. I found the CN by looking here with ADSIedit:

    CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=mydomain,DC=com
  • The name of all enterprise CAs in a domain can be found by running

    certutil -dump
  • My user account doesn't require approval to use that certificate template, so they are issued automatically and downloaded straight away by certreq. I'm not sure how this was set up on the CA, or even if it's a particularly good idea. If the request needs to be approved I believe you'd need to run a separate "certreq -retrieve" command to download the certificate once it's been approved.

Hope this helps someone!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.