Generate a CSR from a certreq policy file

2min
This section shows how to generate a Certificate Signing Request (CSR) from a certreq policy file on the computer where you plan to install Microsoft AD CS. Then, it describes how to create a public/private key pair in your Windows account profile after you generate the CSR file. In a later section, the  issues a signed certificate from the CSR, for you to associate with the public/private key pair stored in the Windows Certificate Store.
Create a Certreq policy file
1
On the computer where you plan to install Microsoft AD CS, open a text editor.
2
Create a new file, then copy and paste the following content into that file:
Text
[Version]
Signature = "$Windows NT$"

[NewRequest]
Subject = "CN=ADCS"
Exportable = TRUE
KeyLength = 2048
MachineKeySet = TRUE
[Version]
Signature = "$Windows NT$"

[NewRequest]
Subject = "CN=ADCS"
Exportable = TRUE
KeyLength = 2048
MachineKeySet = TRUE
﻿
3
Save the file with the .inf extension (such as certreq_policy.inf).
Generate a CSR from the Certreq policy file
1
Open either the command prompt or PowerShell.
2
Go to the directory with the certreq policy .inf file.
3
Run the following command to generate a certificate signing request (CSR) from the certreq policy .inf file:
PowerShell
certreq -new -q -config “your.domain.com\Microsoft ADCS" certreq_policy.inf ADCS.csr
certreq -new -q -config “your.domain.com\Microsoft ADCS" certreq_policy.inf ADCS.csr
﻿
4
Copy the CSR file to the storage medium configured on your .
﻿
Updated 17 Jul 2024
Did this page help you?
Before you start
Configure KMES Series 3