列出CA、certutil或certreq中的所有可用模板

Question

我需要通过命令行请求证书，我已经调查过certreq是可以请求证书的工具。

我习惯于gui通过选择一个可用的模板来请求证书，但是我需要通过命令行进行同样的操作。

对如何实现这一点有什么想法吗？

Answer 1

如果要显示友好的Active证书服务CA提供的证书模板列表(命令行)，请使用certutil -CATemplates。

C:\Windows\system32>certutil -CATemplates
DirectoryEmailReplication: Directory Email Replication -- Auto-Enroll: Access is denied.
DomainControllerAuthentication: Domain Controller Authentication -- Auto-Enroll: Access is denied.
KerberosAuthentication: Kerberos Authentication -- Auto-Enroll: Access is denied.
EFSRecovery: EFS Recovery Agent -- Auto-Enroll: Access is denied.
EFS: Basic EFS -- Auto-Enroll: Access is denied.
DomainController: Domain Controller -- Auto-Enroll: Access is denied.
WebServer: Web Server -- Auto-Enroll: Access is denied.
Machine: Computer -- Auto-Enroll: Access is denied.
User: User -- Auto-Enroll: Access is denied.
SubCA: Subordinate Certification Authority -- Auto-Enroll: Access is denied.
Administrator: Administrator -- Auto-Enroll: Access is denied.
CertUtil: -CATemplates command completed successfully.

此外，它还会告诉您当前是否有权为每个特定模板注册。

若要在其中一个证书模板中注册，请使用：

certreq -enroll -q WebServer

-q参数将取消所有交互式对话框，使其成为纯粹的命令行体验.

Answer 2

使用以下命令列出模板及其详细信息：

certutil.exe -Template

参考资料：https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil