Generates a public/private RSA key pair.
New-RsaKeyPair [-Subject] <String> [-Algorithm <String>] [-ValidFrom <DateTime>] [-ValidTo <DateTime>] [-Length <Int32>] [-Authority <String>] [-PublicKeyFile] <String> [-PrivateKeyFile] <String> [-Force] [<CommonParameters>]
Uses the makecert.exe
and pvk2pfx.exe
programs to generate a public/private RSA key pair, and saves each to files of your choosing. The public key is saved as an X509Certificate. The private key is saved as a PFX file. Both can be loaded by .NET's X509Certificate
class. Returns System.IO.FileInfo
objects for the public and private key, in that order.
You will be prompted for the private key password. Once when creating the private key, once to save it to a file, and finally to export it to a PFX file. Sorry about that: the makecert.exe
tool doesn't have an password command-line parameter. The first two prompts will be GUIs, so you can't run this command headless. To create a password-less private key, click "None" when prompted for the private key password, and leave the other password prompts blank.
makecert.exe
and pvk2pfx.exe
are part of the Windows SDK. They can be downloaded from the following locations:
* [Windows 7](http://www.microsoft.com/en-us/download/details.aspx?id=8279)
* [Windows 8](http://msdn.microsoft.com/en-us/windows/desktop/hh852363.aspx)
* [Windows 8.1](http://msdn.microsoft.com/en-us/windows/desktop/bg162891.aspx)
Name | Type | Description | Required? | Pipeline Input | Default Value |
---|---|---|---|---|---|
Subject | String | The key's subject. Should be of the form CN=Name,OU=Name,O=SuperMagicFunTime,ST=OR,C=US . Only the CN=Name part is required. |
true | false | |
Algorithm | String | The signature algorithm. Default is sha512 . |
false | false | sha512 |
ValidFrom | DateTime | The date/time the keys will become valid. Default is now. | false | false | (Get-Date) |
ValidTo | DateTime | The date/time the keys should expire. Default is DateTime::MaxValue . |
false | false | ([DateTime]::MaxValue) |
Length | Int32 | The length, in bits, of the generated key length. Default is 4096 . |
false | false | 4096 |
Authority | String | The signing authority of the certificate. Must be commercial (for certificates used by commercial software publishers) or individual , for certificates used by individual software publishers. Default is individual . |
false | false | individual |
PublicKeyFile | String | The file where the public key should be stored. Saved as an X509 certificate. | true | false | |
PrivateKeyFile | String | The file where the private key should be stored. The private key will be saved as an X509 certificate in PFX format and will include the public key. | true | false | |
Force | SwitchParameter | Overwrites PublicKeyFile and/or PrivateKeyFile , if they exist. |
false | false | False |
New-RsaKeyPair -Subject 'CN=MyName' -PublicKeyFile 'MyName.cer' -PrivateKeyFile 'MyName.pfx'
Demonstrates the minimal parameters needed to generate a key pair. The key will use a sha512 signing algorithm, have a length of 4096 bits, expire on DateTime::MaxValue
, as an individual
authority. The public key will be saved in the current directory as MyName.cer
. The private key will be saved to the current directory as MyName.pfx
.
New-RsaKeyPair -Subject 'CN=MyName' -PublicKeyFile 'MyName.cer' -PrivateKeyFile 'MyName.pfx' -Algorithm 'sha1' -ValidFrom (Get-Date -Year 2015 -Month 1 -Day 1) -ValidTo (Get-Date -Year 2015 -Month 12 -Day 31) -Length 1024 -Authority 'commercial'
Demonstrates how to use all the parameters to create a truly customized key pair. The generated certificate will use the sha1 signing algorithm, becomes effective 1/1/2015, expires 12/31/2015, is 1024 bits in length, as specifies commercial
as the signing authority.