New-CMCertificateProfileScep
Creates a SCEP certificate profile.
Syntax
New-CMCertificateProfileScep
[-AllowCertificateOnAnyDevice <Boolean>]
[-CertificateStore <CertificateStoreType>]
-CertificateTemplateName <String>
-CertificateValidityDays <Int32>
[-Description <String>]
-Eku <Hashtable>
[-EnrollmentRenewThresholdPct <Int32>]
[-EnrollmentRetryCount <Int32>]
[-EnrollmentRetryDelayMins <Int32>]
-HashAlgorithm <HashAlgorithmTypes>
[-KeySize <Int32>]
[-KeyStorageProvider <KeyStorageProviderSettingType>]
-KeyUsage <X509KeyUsageFlags>
-Name <String>
[-RequireMultifactor]
-RootCertificate <IResultObject>
-SanType <SubjectAlternativeNameFormatTypes>
[-ScepServerUrl <String[]>]
[-SubjectType <SubjectNameFormatTypes>]
-SupportedPlatform <IResultObject[]>
[-DisableWildcardHandling]
[-ForceWildcardHandling]
[-WhatIf]
[-Confirm]
[<CommonParameters>] Description
The New-CMCertificateProfileScep cmdlet creates a Simple Certificate Enrollment Protocol (SCEP) certificate profile.
Note: You must create a trusted CA certificate profile before you can create an SCEP certificate profile. For information about creating a trusted CA certificate profile, see the New-CMCertificateProfileTrustedRootCA cmdlet.
Note
Run Configuration Manager cmdlets from the Configuration Manager site drive, for example PS XYZ:\>. For more information, see getting started.
Examples
Example 1: Create a SCEP certificate profile
PS XYZ:\> New-CMCertificateProfileScep -CertificateTemplateName "TestTemplate01" -CertificateValidityDays 10 -Eku @{ "name1" ="1.2.3.4"; "name2" = "1.2.3.4.5" } -HashAlgorithm SHA2 -KeyUsage KeyEncipherment -Name "TestSCEPProf01" -RootCertificate (New-CMCertificateProfileTrustedRootCA -Name testing -Path "\\Server\Sharefolder\RootCA.cer" -SupportedPlatform (Get-CMSupportedPlatform -Fast -Name "All Windows 10*Client")) -SanType SubjectAltReqiureEmail -SupportedPlatform (Get-CMSupportedPlatform -Fast -Name "All Windows 10*Client")This command creates a trusted root CA certificate, and gets all Windows 10 Client supported platforms. The command then creates a SEP certificate profile using the newly created trusted root CA certificate.
Example 2: Create a SCEP certificate profile and set the certificate store to User
PS XYZ:\> New-CMCertificateProfileScep -CertificateTemplateName "TestTemplate02" -CertificateValidityDays 10 -Eku @{ "name1" ="1.2.3.4"; "name2" = "1.2.3.4.5" } -HashAlgorithm ShA1 -KeyUsage Digitalsignature -Name "TestSCEPProf02" -RootCertificate (New-CMCertificateProfileTrustedRootCA -Name testingSecond -Path "\\Server\Sharefolder\RootCA.cer" -SupportedPlatform (Get-CMSupportedPlatform -Fast -Name "All Windows 10*Client")) -SupportedPlatform (Get-CMSupportedPlatform -Fast -Name "All Windows 10*Client") -CertificateStore User -Description "Test description" -EnrollmentRenewThresholdPct 2 -EnrollmentRetryCount 5 -EnrollmentRetryDelayMins 7 -KeySize 2048 -KeyStorageProvider InstallToTPM_FailIfNotPresent -RequireMultiFactor -SubjectType SubjectRequireEmail -SanType SubjectAltReqiureEmailThis command creates a trusted root CA certificate, and gets all Windows 10 Client supported platforms. The command then creates a SCEP certificate using the newly created root CA certificate and setting the certificate store to User.
Parameters
-AllowCertificateOnAnyDevice
Indicates whether to allow certificate enrollment on any device.
| Type: | Boolean |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-CertificateStore
Specifies the certificate type. Valid values are:
- Machine
- User
| Type: | CertificateStoreType |
| Accepted values: | Machine, User |
| Position: | Named |
| Default value: | User |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-CertificateTemplateName
Specifies the name of a certificate template.
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-CertificateValidityDays
Specifies, in number of days, the certificate validity period.
| Type: | Int32 |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Confirm
Prompts you for confirmation before running the cmdlet.
| Type: | SwitchParameter |
| Aliases: | cf |
| Position: | Named |
| Default value: | False |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Description
Specifies a description for the SCEP certificate profile.
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-DisableWildcardHandling
This parameter treats wildcard characters as literal character values. You can't combine it with ForceWildcardHandling.
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Eku
Specifies the extended key usage. The values in the hash table define the certificate's intended purpose.
| Type: | Hashtable |
| Aliases: | Ekus |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-EnrollmentRenewThresholdPct
Specifies the percentage of the certificate lifetime that remains before the device requests renewal of the certificate.
| Type: | Int32 |
| Position: | Named |
| Default value: | 20 |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-EnrollmentRetryCount
Specifies the number of times that the device automatically retries the certificate request to the server that is running the Network Device Enrollment Service.
| Type: | Int32 |
| Position: | Named |
| Default value: | 3 |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-EnrollmentRetryDelayMins
Specifies the interval, in minutes, between each enrollment attempt when you use CA manager approval before the issuing CA processes the certificate request.
| Type: | Int32 |
| Position: | Named |
| Default value: | 1 |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-ForceWildcardHandling
This parameter processes wildcard characters and may lead to unexpected behavior (not recommended). You can't combine it with DisableWildcardHandling.
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-HashAlgorithm
Specifies one or more hash algorithm. Valid values are:
- SHA1
- SHA2
- SHA3
| Type: | HashAlgorithmTypes |
| Aliases: | HashAlgorithms |
| Accepted values: | SHA1, SHA2, SHA3 |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-KeySize
Specifies the size of the key. Valid values are:
- 1024
- 2048
| Type: | Int32 |
| Accepted values: | 1024, 2048, 4096 |
| Position: | Named |
| Default value: | 2048 |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-KeyStorageProvider
Specifies the Key Storage Provider (KSP) for the SCEP enrollment. Valid values are:
- None
- InstallToTPM_FailIfNotPresent
- InstallToTPM_IfPresent
- InstallToSoftwareKeyStorageProvider
- InstallToNGC_FailIfNotPresent
| Type: | KeyStorageProviderSettingType |
| Accepted values: | None, InstallToTPM_FailIfNotPresent, InstallToTPM_IfPresent, InstallToSoftwareKeyStorageProvider, InstallToNGC_FailIfNotPresent |
| Position: | Named |
| Default value: | InstallToTPM_IfPresent |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-KeyUsage
Specifies one or more key usage for the certificate. Valid values are:
- KeyEncipherment
- DigitalSignature
| Type: | X509KeyUsageFlags |
| Accepted values: | KeyEncipherment, DigitalSignature |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Name
Specifies a name for the SCEP certificate profile.
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-RequireMultifactor
Indicates that multi-factor authentication is required during enrollment of devices before issuing certificates to those devices. This parameter can be used when the InstallToNGC_FailIfNotPresent value is set for the KeyStorageProvider parameter.
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-RootCertificate
Specifies a trusted root CA certificate object. To get a trusted root CA certificate, use the Get-CMCertificateProfileTrustedRootCA function.
| Type: | IResultObject |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-SanType
Specifies one or more subject alternative name. Valid values are:
- SubjectAltRequireSpn
- SubjectAltRequireUpn
- SubjectAltReqiureEmail
- SubjectAltRequireDns
| Type: | SubjectAlternativeNameFormatTypes |
| Aliases: | SanTypes |
| Accepted values: | SubjectAltRequireCustom, SubjectAltRequireSpn, SubjectAltRequireAAD, SubjectAltRequireUpn, SubjectAltReqiureEmail, SubjectAltRequireDns |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-ScepServerUrl
Specifies an array of URLs for the Network Device Enrollment Service (NDES) servers that will issue certificates via SCEP.
| Type: | String[] |
| Aliases: | ScepServerUrls |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-SubjectType
Specifies the subject name format. Valid values are:
- SubjectRequireCommonNameAsEmail
- SubjectRequireCommonNameAsDeviceName
- SubjectRequireCommonNameAsOSName
- SubjectRequireCommonNameAsIMEI
- SubjectRequireCommonNameAsMEID
- SubjectRequireCommonNameAsSerialNumber
- SubjectRequireCommonNameAsDeviceType
- SubjectRequireCommonNameAsWiFiMAC
- SubjectRequireCommonNameAsEthernetMAC
- SubjectRequireAsCustomString
- SubjectRequireDnsAsCN
- SubjectRequireEmail
- SubjectRequireCommonName
- SubjectRequireDirectoryPath
| Type: | SubjectNameFormatTypes |
| Aliases: | SubjectTypes |
| Accepted values: | SubjectRequireCommonNameAsEmail, SubjectRequireCommonNameAsDeviceName, SubjectRequireCommonNameAsOSName, SubjectRequireCommonNameAsIMEI, SubjectRequireCommonNameAsMEID, SubjectRequireCommonNameAsSerialNumber, SubjectRequireCommonNameAsDeviceType, SubjectRequireCommonNameAsWiFiMAC, SubjectRequireCommonNameAsEthernetMAC, SubjectRequireAsCustomString, SubjectRequireDnsAsCN, SubjectRequireEmail, SubjectRequireCommonName, SubjectRequireDirectoryPath |
| Position: | Named |
| Default value: | SubjectRequireCommonName |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-SupportedPlatform
Specifies a supported platform object. To obtain a supported platform object, use the Get-CMSupportedPlatform cmdlet.
| Type: | IResultObject[] |
| Aliases: | SupportedPlatforms |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-WhatIf
Shows what would happen if the cmdlet runs. The cmdlet doesn't run.
| Type: | SwitchParameter |
| Aliases: | wi |
| Position: | Named |
| Default value: | False |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
Inputs
None
Outputs
IResultObject
Related Links
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for