New-RsaKeyPair

Generates a public/private RSA key pair.

Syntax

New-RsaKeyPair [-Subject] <String> [-Algorithm <String>] [-ValidFrom <DateTime>] [-ValidTo <DateTime>] [-Length <Int32>] [-Authority <String>] [-PublicKeyFile] <String> [-PrivateKeyFile] <String> [-Force] [<CommonParameters>]

Description

Uses the makecert.exe and pvk2pfx.exe programs to generate a public/private RSA key pair, and saves each to files of your choosing. The public key is saved as an X509Certificate. The private key is saved as a PFX file. Both can be loaded by .NET's X509Certificate class. Returns System.IO.FileInfo objects for the public and private key, in that order.

You will be prompted for the private key password. Once when creating the private key, once to save it to a file, and finally to export it to a PFX file. Sorry about that: the makecert.exe tool doesn't have an password command-line parameter. The first two prompts will be GUIs, so you can't run this command headless. To create a password-less private key, click "None" when prompted for the private key password, and leave the other password prompts blank.

makecert.exe and pvk2pfx.exe are part of the Windows SDK. They can be downloaded from the following locations:

* [Windows 7](http://www.microsoft.com/en-us/download/details.aspx?id=8279)
* [Windows 8](http://msdn.microsoft.com/en-us/windows/desktop/hh852363.aspx)
* [Windows 8.1](http://msdn.microsoft.com/en-us/windows/desktop/bg162891.aspx)

Related Commands

Parameters

Name Type Description Required? Pipeline Input Default Value
Subject String The key's subject. Should be of the form CN=Name,OU=Name,O=SuperMagicFunTime,ST=OR,C=US. Only the CN=Name part is required. true false
Algorithm String The signature algorithm. Default is sha512. false false sha512
ValidFrom DateTime The date/time the keys will become valid. Default is now. false false (Get-Date)
ValidTo DateTime The date/time the keys should expire. Default is DateTime::MaxValue. false false ([DateTime]::MaxValue)
Length Int32 The length, in bits, of the generated key length. Default is 4096. false false 4096
Authority String The signing authority of the certificate. Must be commercial (for certificates used by commercial software publishers) or individual, for certificates used by individual software publishers. Default is individual. false false individual
PublicKeyFile String The file where the public key should be stored. Saved as an X509 certificate. true false
PrivateKeyFile String The file where the private key should be stored. The private key will be saved as an X509 certificate in PFX format and will include the public key. true false
Force SwitchParameter Overwrites PublicKeyFile and/or PrivateKeyFile, if they exist. false false False

Return Values

System.IO.FileInfo.

EXAMPLE 1

New-RsaKeyPair -Subject 'CN=MyName' -PublicKeyFile 'MyName.cer' -PrivateKeyFile 'MyName.pfx'

Demonstrates the minimal parameters needed to generate a key pair. The key will use a sha512 signing algorithm, have a length of 4096 bits, expire on DateTime::MaxValue, as an individual authority. The public key will be saved in the current directory as MyName.cer. The private key will be saved to the current directory as MyName.pfx.

EXAMPLE 2

New-RsaKeyPair -Subject 'CN=MyName' -PublicKeyFile 'MyName.cer' -PrivateKeyFile 'MyName.pfx' -Algorithm 'sha1' -ValidFrom (Get-Date -Year 2015 -Month 1 -Day 1) -ValidTo (Get-Date -Year 2015 -Month 12 -Day 31) -Length 1024 -Authority 'commercial'

Demonstrates how to use all the parameters to create a truly customized key pair. The generated certificate will use the sha1 signing algorithm, becomes effective 1/1/2015, expires 12/31/2015, is 1024 bits in length, as specifies commercial as the signing authority.