I am trying to configure a subordinate CA using a .PFX file with PowerShell. I am using the below parameters:

$params = @{
    CAType = "EnterpriseSubordinateCA"
    Credential = $credential
    CertFile = C:\PKI\MyCert.pfx
    CertFilePassword = $password
Install-AdcsCertificationAuthority @params -Whatif

What if: Certification authority will be installed with the following properties:
CAType: EnterpriseSubordinateCA
CryptoProviderName: RSA#Microsoft Software Key Storage Provider
HashAlgorithmName: SHA1

Even though MyCert.pfx file is SHA256, the cmdlet -Whatif shows SHA1.

If I use server manager to configure AD-CS and import the .PFX file, it correctly installs using SHA256

Am I missing something? Or is the cmdlet bugged.


You need to add -HashAlgorithmName sha256 as a parameter to to your cmdlet (or in your case, HashAlgorithmName = "sha256" to your splatting variable) to configure the algorithm used to sign certificates. That algorithm is not necessarily the same as that of the CA certificate signing it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.