1

I need to request a certificate via command line I have investigated that certreq is the tool that can request the certificate.

I am used to the gui to request the certificate by selecting one of the available templates, but I need to do the same via command line.

Any ideas about how to achieve this?

3

If you want to display a list (in the command line) of certificate templates that are on offer by your friendly Active Directory Certificate Services CA, use certutil -CATemplates.

C:\Windows\system32>certutil -CATemplates
DirectoryEmailReplication: Directory Email Replication -- Auto-Enroll: Access is denied.
DomainControllerAuthentication: Domain Controller Authentication -- Auto-Enroll: Access is denied.
KerberosAuthentication: Kerberos Authentication -- Auto-Enroll: Access is denied.
EFSRecovery: EFS Recovery Agent -- Auto-Enroll: Access is denied.
EFS: Basic EFS -- Auto-Enroll: Access is denied.
DomainController: Domain Controller -- Auto-Enroll: Access is denied.
WebServer: Web Server -- Auto-Enroll: Access is denied.
Machine: Computer -- Auto-Enroll: Access is denied.
User: User -- Auto-Enroll: Access is denied.
SubCA: Subordinate Certification Authority -- Auto-Enroll: Access is denied.
Administrator: Administrator -- Auto-Enroll: Access is denied.
CertUtil: -CATemplates command completed successfully.

Bonus, it also tells you whether you currently have the right to enroll for each particular template.

To enroll in one of the certificate templates, use:

certreq -enroll -q WebServer

The -q parameter suppresses all interactive dialog boxes, making it a purely command-line-only experience.

| improve this answer | |
  • how do I see details for each template? If I do "request new certificate" in mmc certificate snap-in there I can see it, but via command? – Vitas Aug 31 '17 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.