My 2008 powershell script is not working correctly in 2012r2. The command

New-SelfSignedCertificate -DnsName test.testdomain.com -NotBefore [datetime]::now.AddYears(10) 

comes back with:

New-SelfSignedCertificate : A parameter cannot be found that matches parameter name 'NotBefore'

I ran this ok in Windows 10 as a test...

I do not (cannot) download an old version of selfssl to perform this (yes I know about this). It needs to be done in powershell or I'll have to look at gemerating these certs in openssl on another box.

Anyone know what is going on with this?


As Sam mentioned, this parameter was introduced in Windows 10 and is not available on previous versions.

As an alternative solution, I would suggest a custom PowerShell script I wrote years ago: https://gallery.technet.microsoft.com/scriptcenter/Self-signed-certificate-5920a7c6 the page contains all parameter description and usage examples.


  • The script is great, I used this as a basis for my scripts, but was it unfinished? I see StoreName as a parameter mentioned but not in the script, and StoreLocation is a bit more hardcoded. My main miss on the 2016 is is the "-signer" tag, though. – LimpingNinja May 16 '17 at 13:54
  • how do we use this script? – ArgeKumandan Apr 11 '18 at 20:12

NotBefore is only available in Windows 10/Server 2016 Technical preview. If you look at this page and change the OS in the drop down you will see it is not present for 2012 R2.

  • Well humdinger... Is there another way in powershell do this? – Zonus Mar 7 '16 at 21:20
  • Why don't you copy the PS module from 10 and put it on the 2012 server? – user5870571 Mar 7 '16 at 23:04
  • @user5870571 I'm fairly sure it's not missing because they didn't include it in the PS module, but that the underlying functionality is not in 2012 R2 – Sam Cogan Mar 8 '16 at 11:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.