Share via

get-certificate with Subject Alternate Name (SAN) to include IP Addresses

GreenerJay 41 Reputation points
2022-05-18T16:19:02.867+00:00

Hi

I have a powershell script that will obtain a certificate from our Enterprise CA that works well. That being said, I am trying to include a parameter that will provide me with an IP address in the subject alternate name field. Anything I put after the -DnsName parameter gets included as a DNS name, not an IP Address. I need the IP Address to appear in the SAN list as IP Address = x.x.x.x, not DNS Name=x.x.x.x - otherwise the browser will throw an error if I access it via IP Address

The cmdlet I'm using is get-certificate. I use different variables to tie it all together and they work - again, I just need an IP Address in my Subject Alternate Name field.

Get-Certificate -Url https://serverpath/pathtoCEP -Credential $cert -Template StandAlone -CertStoreLocation Cert:\LocalMachine\my -SubjectName cn=$subject -Dns=$subject

I've attached an image to clarify what I'm talking about. The image shows the end result of what I want (ignore the rfc822 stuff)

203244-san.png

Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,435 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. DaveK 1,851 Reputation points
    2022-05-19T19:47:52.517+00:00

    I'd done something which may help with this but its a much longer script but would give you a lot more flexibility.

    Consider creating the CSR manually yourself and then using this with the Get-Certificate command rather than specifying the DNS on the commandline.

    Take a look at this GitHub example - Not mine but the closest example I could find of the type of thing I mean - https://gist.github.com/paschott/966f5ae8b1eda5efce874914d95aafd9

    I'm doing something similar with OpenSSL to create requests I can use to fire over to DigiCert for creating duplicates from a wildcard and its been working well for my use case. I haven't tried this myself on our Internal PKI but I didn't spot anything which jumps out to make me think this isn't something which might work.

    0 comments
  2. GreenerJay 41 Reputation points
    2022-06-07T16:16:38.013+00:00

    Thanks for the reply. We are automating hundreds of certificate requests for mobile devices so generating the CSR manually wouldn't work. I've thought about using a script to create a template (.inf) file but even that would get tedious after a hundred uses.

  3. DaveK 1,851 Reputation points
    2022-06-09T12:27:37.923+00:00

    Maybe my choice of words isn't ideal there, I've used CSR's as I'm submitting to a external provider but in your case, I see no reason why you can't dynamically create the .inf files and submit the requests just like in the example on github.

    I'm curious in case I'm misunderstanding something so bear with me but how would scripting the creation of the .inf files to automate the requests become tedious after a hundred uses?

    In your existing solution mentioned in your initial post, do you run the script once per required certificate? or are the IP's etc fed into a loop which produced a number of certs for you?

    0 comments