New-AzKeyVaultCertificatePolicy
Creates an in-memory certificate policy object.
Syntax
SubjectName (Default)
New-AzKeyVaultCertificatePolicy
[-IssuerName] <String>
[-SubjectName] <String>
[-RenewAtNumberOfDaysBeforeExpiry <Int32>]
[-RenewAtPercentageLifetime <Int32>]
[-SecretContentType <String>]
[-ReuseKeyOnRenewal]
[-Disabled]
[-KeyUsage <System.Collections.Generic.List`1[System.Security.Cryptography.X509Certificates.X509KeyUsageFlags]>]
[-Ekus <System.Collections.Generic.List`1[System.String]>]
[-ValidityInMonths <Int32>]
[-CertificateType <String>]
[-EmailAtNumberOfDaysBeforeExpiry <Int32>]
[-EmailAtPercentageLifetime <Int32>]
[-KeyType <String>]
[-KeySize <Int32>]
[-KeyNotExportable]
[-CertificateTransparency <Boolean>]
[-Curve <String>]
[-DefaultProfile <IAzureContextContainer>]
[-WhatIf]
[-Confirm]
[<CommonParameters>]
DNSNames
New-AzKeyVaultCertificatePolicy
[-IssuerName] <String>
[[-SubjectName] <String>]
[-DnsName] <System.Collections.Generic.List`1[System.String]>
[-RenewAtNumberOfDaysBeforeExpiry <Int32>]
[-RenewAtPercentageLifetime <Int32>]
[-SecretContentType <String>]
[-ReuseKeyOnRenewal]
[-Disabled]
[-KeyUsage <System.Collections.Generic.List`1[System.Security.Cryptography.X509Certificates.X509KeyUsageFlags]>]
[-Ekus <System.Collections.Generic.List`1[System.String]>]
[-ValidityInMonths <Int32>]
[-CertificateType <String>]
[-EmailAtNumberOfDaysBeforeExpiry <Int32>]
[-EmailAtPercentageLifetime <Int32>]
[-KeyType <String>]
[-KeySize <Int32>]
[-KeyNotExportable]
[-CertificateTransparency <Boolean>]
[-Curve <String>]
[-DefaultProfile <IAzureContextContainer>]
[-WhatIf]
[-Confirm]
[<CommonParameters>]
Description
The New-AzKeyVaultCertificatePolicy cmdlet creates an in-memory certificate policy object for Azure Key Vault.
Examples
Example 1: Create a certificate policy
New-AzKeyVaultCertificatePolicy -SecretContentType "application/x-pkcs12" -SubjectName "CN=contoso.com" -IssuerName "Self" -ValidityInMonths 6 -ReuseKeyOnRenewal
SecretContentType : application/x-pkcs12
Kty :
KeySize : 2048
Curve :
Exportable :
ReuseKeyOnRenewal : True
SubjectName : CN=contoso.com
DnsNames :
KeyUsage :
Ekus :
ValidityInMonths : 6
IssuerName : Self
CertificateType :
RenewAtNumberOfDaysBeforeExpiry :
RenewAtPercentageLifetime :
EmailAtNumberOfDaysBeforeExpiry :
EmailAtPercentageLifetime :
CertificateTransparency :
Enabled : True
Created :
Updated :
This command creates a certificate policy that is valid for six months and reuses the key to renew the certificate.
Example 2
Creates an in-memory certificate policy object. (autogenerated)
New-AzKeyVaultCertificatePolicy -IssuerName 'Self' -KeyType RSA -RenewAtNumberOfDaysBeforeExpiry <Int32> -SecretContentType application/x-pkcs12 -SubjectName 'CN=contoso.com' -ValidityInMonths 6
Example 3: Create a Subject Alternate Name (or SAN) certificate
New-AzKeyVaultCertificatePolicy -SecretContentType "application/x-pkcs12" -SubjectName "CN=contoso.com" -DnsName "contoso.com","support.contoso.com","docs.contoso.com" -IssuerName "Self"
SecretContentType : application/x-pkcs12
Kty : RSA
KeySize : 2048
Curve :
Exportable :
ReuseKeyOnRenewal : False
SubjectName : CN=contoso.com
DnsNames : {contoso.com, support.contoso.com, docs.contoso.com}
KeyUsage :
Ekus :
ValidityInMonths :
IssuerName : Self
CertificateType :
RenewAtNumberOfDaysBeforeExpiry :
RenewAtPercentageLifetime :
EmailAtNumberOfDaysBeforeExpiry :
EmailAtPercentageLifetime :
CertificateTransparency :
Enabled : True
Created :
Updated :
This example creates a SAN certificate with 3 DNS names.
Parameters
-CertificateTransparency
Indicates whether certificate transparency is enabled for this certificate/issuer; if not specified, the default is 'true'
Parameter properties
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-CertificateType
Specifies the type of certificate to the issuer.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-Confirm
Prompts you for confirmation before running the cmdlet.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False Aliases: cf
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-Curve
Specifies the elliptic curve name of the key of the certificate.
The acceptable values for this parameter are:
P-256
P-384
P-521
P-256K
SECP256K1
Parameter properties
Type: String
Default value: None Accepted values: P-256, P-384, P-521, P-256K, SECP256K1 Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-DefaultProfile
The credentials, account, tenant, and subscription used for communication with azure
Parameter properties
Type: IAzureContextContainer
Default value: None Supports wildcards: False DontShow: False Aliases: AzContext, AzureRmContext, AzureCredential
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-Disabled
Indicates that the certificate policy is disabled.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-DnsName
Specifies the DNS names in the certificate. Subject Alternative Names (SANs) can be specified as DNS names.
Parameter properties
Type: List<T> [ String ]
Default value: None Supports wildcards: False DontShow: False Aliases: DnsNames
Parameter sets
DNSNames
Position: 1 Mandatory: True Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-Ekus
Specifies the enhanced key usages (EKUs) in the certificate.
Parameter properties
Type: List<T> [ String ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-EmailAtNumberOfDaysBeforeExpiry
Specifies how many days before expiry the automatic notification process begins.
Parameter properties
Type: Nullable<T> [ Int32 ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-EmailAtPercentageLifetime
Specifies the percentage of the lifetime after which the automatic process for the notification begins.
Parameter properties
Type: Nullable<T> [ Int32 ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-IssuerName
Specifies the name of the issuer for the certificate.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: 0 Mandatory: True Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-KeyNotExportable
Indicates that the key is not exportable.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-KeySize
Specifies the key size of the certificate.
The acceptable values for this parameter are:
2048
3072
4096
256
384
521
Parameter properties
Type: Int32
Default value: None Accepted values: 2048, 3072, 4096, 256, 384, 521 Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-KeyType
Specifies the key type of the key that backs the certificate.
The acceptable values for this parameter are:
Parameter properties
Type: String
Default value: RSA Accepted values: RSA, RSA-HSM, EC, EC-HSM Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-KeyUsage
Specifies the key usages in the certificate.
Parameter properties
Type: List<T> [ X509KeyUsageFlags ]
Default value: None Accepted values: None, EncipherOnly, CrlSign, KeyCertSign, KeyAgreement, DataEncipherment, KeyEncipherment, NonRepudiation, DigitalSignature, DecipherOnly Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-RenewAtNumberOfDaysBeforeExpiry
Specifies the number of days before expiry after which the automatic process for certificate renewal begins.
Parameter properties
Type: Nullable<T> [ Int32 ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-RenewAtPercentageLifetime
Specifies the percentage of the lifetime after which the automatic process for certificate renewal begins.
Parameter properties
Type: Nullable<T> [ Int32 ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-ReuseKeyOnRenewal
Indicates that the certificate reuse the key during renewal.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-SecretContentType
Specifies the content type of the new key vault secret.
The acceptable values for this parameter are:
application/x-pkcs12
application/x-pem-file
Parameter properties
Type: String
Default value: None Accepted values: application/x-pkcs12, application/x-pem-file Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-SubjectName
Specifies the subject name of the certificate.
Note
If you must use a comma (,) or a period (.) within a property in the SubjectName parameter,
you must enclose the property field in quotation marks. For example, you may use O="Contoso, Ltd." in the Organization Name field.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
SubjectName
Position: 1 Mandatory: True Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-ValidityInMonths
Specifies the number of months the certificate is valid.
Parameter properties
Type: Nullable<T> [ Int32 ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-WhatIf
Shows what would happen if the cmdlet runs.
The cmdlet is not run.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False Aliases: wi
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable,
-InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable,
-ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see
about_CommonParameters .
Outputs
