Create Self-Signed certificates for point-to-site in Azure

by

PowerShell commands to create Root and Child Certificate for the Azure P2S

Create a self-signed root certificate

$params = @{
    Type = 'Custom'
    Subject = 'CN=P2SRootCert'
    KeySpec = 'Signature'
    KeyExportPolicy = 'Exportable'
    KeyUsage = 'CertSign'
    KeyUsageProperty = 'Sign'
    KeyLength = 2048
    HashAlgorithm = 'sha256'
    NotAfter = (Get-Date).AddMonths(24)
    CertStoreLocation = 'Cert:\CurrentUser\My'
}
$cert = New-SelfSignedCertificate @params

Create a self-signed Child certificate on the PowerShell console session if it is still open

$params = @{
       Type = 'Custom'
       Subject = 'CN=P2SChildCert'
       DnsName = 'P2SChildCert'
       KeySpec = 'Signature'
       KeyExportPolicy = 'Exportable'
       KeyLength = 2048
       HashAlgorithm = 'sha256'
       NotAfter = (Get-Date).AddMonths(18)
       CertStoreLocation = 'Cert:\CurrentUser\My'
       Signer = $cert
       TextExtension = @(
        '2.5.29.37={text}1.3.6.1.5.5.7.3.2')
   }
   New-SelfSignedCertificate @params

On the new PowerShell console session

Get-ChildItem -Path "Cert:\CurrentUser\My"

Locate the root certificate

Thumbprint                                Subject
----------                                -------
AED812AD883826FF76B4D1D5A77B3C08EFA79F3F  CN=P2SChildCert4
7181AA8C1B4D34EEDB2F3D3BEC5839F3FE52D655  CN=P2SRootCert

Replace the THUMBPRINT

$cert = Get-ChildItem -Path "Cert:\CurrentUser\My\<THUMBPRINT>"

And Execute the below script

$params = @{
    Type = 'Custom'
    Subject = 'CN=P2SChildCert'
    DnsName = 'P2SChildCert1'
    KeySpec = 'Signature'
    KeyExportPolicy = 'Exportable'
    KeyLength = 2048
    HashAlgorithm = 'sha256'
    NotAfter = (Get-Date).AddMonths(18)
    CertStoreLocation = 'Cert:\CurrentUser\My'
    Signer = $cert
    TextExtension = @(
     '2.5.29.37={text}1.3.6.1.5.5.7.3.2')
}
New-SelfSignedCertificate @params

Export the root without a private key with the Base-64 encoded X.509 (.CER).

Open the exported certificate, copy the certificate content and paste it on the Azure P2S Configuration page.

Export the P2S Child certificate with a Private key and save it on the device.

Source:

https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site

Leave a Comment