PowerShell: PKI-related

powershell_pki.ps1

#Requires -Version 5.1
# Reference: 1) https://learn.microsoft.com/en-us/powershell/module/pki/new-selfsignedcertificate?view=windowsserver2019-ps
# Reference: 2) https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2019-ps

# Example 1: Create new self-signed certificate for use with Cryptographic Message Syntax (CMS) format
$NewCertArgs = @{
    # KeyProtection = "Protect"  # default is None
    # KeyExportPolicy = "Exportable", "ExportableEncrypted"  # default is "ExportableEncrypted"
    KeyLength = 2048
    KeyAlgorithm = "RSA"
    Type = "DocumentEncryptionCert"
    FriendlyName = "CMS Encryption - $($Env:UserName)@$($Env:UserDnsDomain)"
    Subject = @("CN=$($Env:UserName)@$($Env:UserDnsDomain)"
                "O=$($Env:UserDomain)",
                "C=$((Get-WinSystemLocale).Name.Split("-")[-1])"
               ) -join ","
    CertStoreLocation = "Cert:\CurrentUser\My"
}
$Cert = New-SelfSignedCertificate @NewCertArgs

# Example 2: Get user certificates suitable for use with Cryptographic Message Syntax (CMS) format
$Certs = Get-ChildItem -Path "Cert:\CurrentUser\My" | ? {
    $_.EnhancedKeyUsageList.FriendlyName -eq "Document Encryption" -and
    $_.Extensions.KeyUsages -match "DataEncipherment" -and
    $_.Extensions.KeyUsages -match "KeyEncipherment"
}