列出 CA certutil 或 certreq 中的所有可用模板

Question

我需要通过命令行请求证书我已经调查了certreq是可以请求证书的工具。

我习惯使用 GUI 通过选择可用模板之一来请求证书，但我需要通过命令行执行相同的操作。

关于如何实现这一目标有什么想法吗？

Answer 1

如果您想要显示友好的 Active Directory 证书服务 CA 提供的证书模板列表（在命令行中），请使用certutil -CATemplates.

C:\Windows\system32>certutil -CATemplates
DirectoryEmailReplication: Directory Email Replication -- Auto-Enroll: Access is denied.
DomainControllerAuthentication: Domain Controller Authentication -- Auto-Enroll: Access is denied.
KerberosAuthentication: Kerberos Authentication -- Auto-Enroll: Access is denied.
EFSRecovery: EFS Recovery Agent -- Auto-Enroll: Access is denied.
EFS: Basic EFS -- Auto-Enroll: Access is denied.
DomainController: Domain Controller -- Auto-Enroll: Access is denied.
WebServer: Web Server -- Auto-Enroll: Access is denied.
Machine: Computer -- Auto-Enroll: Access is denied.
User: User -- Auto-Enroll: Access is denied.
SubCA: Subordinate Certification Authority -- Auto-Enroll: Access is denied.
Administrator: Administrator -- Auto-Enroll: Access is denied.
CertUtil: -CATemplates command completed successfully.

另外，它还告诉您当前是否有权注册每个特定模板。

要注册证书模板之一，请使用：

certreq -enroll -q WebServer

该-q参数会抑制所有交互式对话框，使其成为纯粹的命令行体验。