Powershell New-SelfSignedCertificate missing -NotBefore in Windows 2012r2

Question

My 2008 powershell script is not working correctly in 2012r2. The command

New-SelfSignedCertificate -DnsName test.testdomain.com -NotBefore [datetime]::now.AddYears(10)

comes back with:

New-SelfSignedCertificate : A parameter cannot be found that matches parameter name 'NotBefore'

I ran this ok in Windows 10 as a test...

I do not (cannot) download an old version of selfssl to perform this (yes I know about this). It needs to be done in powershell or I'll have to look at gemerating these certs in openssl on another box.

Anyone know what is going on with this?

Possible duplicate of [IIS 7.5 Creating self signed certificates with validation date of more than a year](http://serverfault.com/questions/361792/iis-7-5-creating-self-signed-certificates-with-validation-date-of-more-than-a-ye) — pat o., Mar 07 '16 at 20:55
Not a dup. I know about selfssl; it has to be powershell or I'll have to do this in openssl on another box and copy over the cert. (I really hope I don't have to do that) — Zonus, Mar 07 '16 at 21:22

score 6 · Accepted Answer · answered Mar 08 '16 at 06:29

6

As Sam mentioned, this parameter was introduced in Windows 10 and is not available on previous versions.

As an alternative solution, I would suggest a custom PowerShell script I wrote years ago: https://gallery.technet.microsoft.com/scriptcenter/Self-signed-certificate-5920a7c6 the page contains all parameter description and usage examples.

HTH

answered Mar 08 '16 at 06:29

Crypt32

6,639
1
15
33

The script is great, I used this as a basis for my scripts, but was it unfinished? I see StoreName as a parameter mentioned but not in the script, and StoreLocation is a bit more hardcoded. My main miss on the 2016 is is the "-signer" tag, though. – LimpingNinja May 16 '17 at 13:54
how do we use this script? – ArgeKumandan Apr 11 '18 at 20:12

score 3 · Answer 2 · answered Mar 07 '16 at 20:58

3

NotBefore is only available in Windows 10/Server 2016 Technical preview. If you look at this page and change the OS in the drop down you will see it is not present for 2012 R2.

answered Mar 07 '16 at 20:58

Sam Cogan

38,736
6
78
114

Well humdinger... Is there another way in powershell do this? – Zonus Mar 07 '16 at 21:20
Why don't you copy the PS module from 10 and put it on the 2012 server? – user5870571 Mar 07 '16 at 23:04
@user5870571 I'm fairly sure it's not missing because they didn't include it in the PS module, but that the underlying functionality is not in 2012 R2 – Sam Cogan Mar 08 '16 at 11:16

Powershell New-SelfSignedCertificate missing -NotBefore in Windows 2012r2

2 Answers2