How to Use the certreq Command in Windows 11 to Generate, Submit, and Install SSL and Client Certificates

Managing public key infrastructure (PKI), SSL/TLS server certificates, and S/MIME client authentication tokens across Windows environments frequently requires creating Certificate Signing Requests (CSRs). While the Microsoft Management Console (MMC) Certificates snap-in provides a graphical wizard, automating enterprise deployments requires command-line control. The built-in certreq utility in Windows 11 enables administrators to script CSR generation, submit requests directly to Active Directory Certificate Services (AD CS), and accept signed certificates seamlessly.

Why Use certreq Over GUI Wizards?

The certreq command-line tool utilizes plain-text Policy and Request Information files (.inf). By defining cryptographic parameters—such as Subject Alternative Names (SAN), Key Length (e.g. RSA 4096 or ECDSA P-384), Key Usage flags, and Private Key Exportability—within a reproducible configuration file, administrators can eliminate human error and incorporate certificate issuance directly into automated deployment pipelines.

Syntax and Key Parameters

certreq [-new | -submit | -retrieve | -accept | -policy] [options]

• -new [RequestConfig.inf] [OutputRequest.req]: Generates a new private key pair and creates a Base64-encoded CSR file based on parameters in an INF file.
• -submit [options] [Request.req] [Cert.cer]: Submits the request to an available Certificate Authority (CA) on your network.
• -accept [Cert.cer]: Installs the issued certificate into the local Windows Certificate Store and links it to the previously generated private key.
• -retrieve [RequestID] [Cert.cer]: Downloads a previously submitted request held in pending status by a CA administrator.

Step-by-Step Practical Implementation

Step 1: Open an Elevated Command Prompt

1. Press Windows Key + S and type cmd.
2. Right-click Command Prompt and select Run as administrator.

Step 2: Create a Request Configuration File (.inf)

Create a plain-text configuration file named request.inf using Notepad with the following specification:

[Version]
Signature="$Windows NT$"

[NewRequest]
Subject = "CN=intranet.company.local, O=Company Ltd, C=GB"
KeyLength = 4096
KeySpec = 1
KeyUsage = 0xA0
MachineKeySet = True
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
Exportable = True
RequestType = PKCS10

[Extensions]
2.5.29.17 = "{text}dns=intranet.company.local&dns=web01.company.local"

Step 3: Generate the Private Key and CSR (.req)

Execute certreq -new pointing to your configuration file:

certreq -new request.inf intranet_request.req

Windows generates a new 4096-bit RSA private key in the local machine store and exports the cryptographic CSR to intranet_request.req.

Step 4: Submit the Request to a Certificate Authority

To submit the request to an Active Directory Certificate Authority:

certreq -submit intranet_request.req intranet_cert.cer

If multiple enterprise CAs exist, an interactive selection dialogue will prompt you to choose the target authority.

Step 5: Accept and Install the Certificate

Once issued, install the certificate back into the local system store:

certreq -accept intranet_cert.cer

The command matches the signed public key with the private key container created during Step 3, completing the certificate lifecycle.

certreq Action Verbs Operational Reference

Action Verb	Primary Input	Generated Output	Cryptographic State	Key Benefit
-new	INF configuration file	REQ file (Base64 CSR)	Creates orphaned private key in local store	Defines granular Subject Alternative Names (SANs)
-submit	REQ file	CER file or Request ID	Transmits CSR to CA over RPC/DCOM	Direct integration with AD CS without web enrolment
-accept	CER file	Certificate in Store	Binds public cert to local private key	Makes certificate active for IIS, WinRM, and RDP
-retrieve	Request ID from CA	CER file	Pulls approved cert from pending queue	Resolves delayed approvals from CA managers

Troubleshooting Common Errors

• “Cannot find the certificate and private key for decryption”: Occurs when executing -accept on a different computer than the one where -new was originally run. The private key resides strictly on the initiating machine.
• Access Denied (0x80070005): Occurs when setting MachineKeySet = True in the INF file without running Command Prompt with administrative privileges.
• Invalid Character in SAN: Ensure that Subject Alternative Name entries use ampersands (&) between multiple DNS names in the 2.5.29.17 extension section.