title: Generate Self-signed certificate with Root CA Signer
body: <p>Scenario: I am using PowerShell on <em>Windows Server 2012r2</em> to generate a Root certificate and want to use that to sign a newly created Intermediate and Web certificate in dynamic generated (and destroyed) dev/test environments. The scripts are deployed remotely, and the intent is to keep it pure PowerShell if possible. In Windows 10/2016 this is relatively easy, after generating the Root certificate:</p>
  
  <pre><code>$Cert = New-SelfSignedCertificate -Signer $Root -Subject "CN=$Subject"
  </code></pre>
  
  <p>I've generated the Root certificate using COM <code>X509Enrollment.CX509CertificateRequestCertificate</code> and <code>Security.Cryptography.X509Certificates.X509Certificate2</code> in a bastardized PS that I've had for some time, mainly because I needed to ensure that the Subject and Usage were set very specifically. I am not quite certain how to use this to sign the standard certificate without the above (which I have used before).</p>
  
  <p>There are some examples using Bouncy Castle (see below) in C# that I could tie into PowerShell, but then I would need to deploy this additionally on the dynamic dev/test environments and I want to be able to do this in Powershell (via COM if needed) with the least dependencies.</p>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/22230745/generate-self-signed-certificate-on-the-fly">C# Generate Self Signed Certificates on the Fly</a></li>
  <li><a href="http://blog.differentpla.net/blog/2013/04/17/how-do-i-use-bouncy-castle-from-powershell" rel="noreferrer">How do I use Bouncy Castle in Powershell</a></li>
  </ul>