PowerShell创建自签名证书的5个高级玩法：从代码签名到邮件加密，不止于HTTPS

PowerShell自签名证书的5个高阶应用场景从代码签名到企业级加密在Windows生态系统中自签名证书常被简单理解为HTTPS测试的替代方案但New-SelfSignedCertificate命令的-Type参数如同瑞士军刀的隐藏功能能解锁代码签名、邮件加密、文档保护等企业级应用。本文将揭示系统管理员实际工作中最需要的5种高阶玩法每个场景均附带可立即执行的PowerShell脚本和验证方法。1. 代码签名证书为脚本和可执行文件加上数字指纹代码签名是防止脚本被篡改的第一道防线。通过以下命令生成专用于代码签名的证书$params { Type CodeSigningCert Subject CNPowerShell Script Signing Authority KeyUsage DigitalSignature KeyExportPolicy Exportable CertStoreLocation Cert:\CurrentUser\My HashAlgorithm sha256 NotAfter (Get-Date).AddYears(2) } $cert New-SelfSignedCertificate params验证签名有效性# 为脚本签名 Set-AuthenticodeSignature -FilePath .\script.ps1 -Certificate $cert # 检查签名状态 Get-AuthenticodeSignature .\script.ps1 | Select-Object Status,SignerCertificate注意代码签名证书需配合Set-ExecutionPolicy RemoteSigned使用避免签名后被恶意修改2. S/MIME邮件加密构建内部安全通信体系利用-Type DocumentEncryptionCert参数创建适用于Outlook等客户端的邮件加密证书$mailCert New-SelfSignedCertificate -Type DocumentEncryptionCert -Subject CNInternal Email Encryption, OUSecurity Team -KeyUsage KeyEncipherment -TextExtension (2.5.29.37{text}1.3.6.1.5.5.7.3.4) -CertStoreLocation Cert:\CurrentUser\My部署到邮件客户端导出证书并分发给团队成员$password ConvertTo-SecureString -String ComplexPassword123! -Force -AsPlainText Export-PfxCertificate -Cert $mailCert -FilePath EmailEncryption.pfx -Password $password在Outlook中导入PFX文件并设置为默认加密证书证书属性对比表参数代码签名证书邮件加密证书-TypeCodeSigningCertDocumentEncryptionCert主要用途验证脚本完整性加密邮件内容密钥用法DigitalSignatureKeyEncipherment扩展密钥用法1.3.6.1.5.5.7.3.31.3.6.1.5.5.7.3.43. 文档加密证书保护敏感企业文件通过组合-Container和-KeyLength参数创建高强度文档加密证书$docCert New-SelfSignedCertificate -Type DocumentEncryptionCertLegacyCsp -Subject CNConfidential Document Encryption -KeyLength 4096 -Provider Microsoft Enhanced RSA and AES Cryptographic Provider -KeyExportPolicy ExportableEncrypted -KeyUsage DataEncipherment实际应用场景使用证书加密Excel/Word文档# 导出公钥用于加密 Export-Certificate -Cert $docCert -FilePath DocEncrypt.cer -Type CERT通过certmgr.msc管理证书的访问权限4. 内部根证书构建测试用PKI体系模拟企业CA环境需要创建自签名根证书$rootCert New-SelfSignedCertificate -Type Custom -Subject CNInternal Root CA, DCcontoso, DCcom -KeyUsage CertSign,CRLSign -KeyUsageProperty All -KeyLength 4096 -HashAlgorithm sha384 -NotAfter (Get-Date).AddYears(10) -TextExtension ( 2.5.29.19{text}CAtruepathlength3, 2.5.29.37{text}1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2 )部署到信任存储区# 将根证书移动到受信任的根证书颁发机构 Move-Item -Path $rootCert.PSPath -Destination Cert:\LocalMachine\Root5. 证书克隆与修改快速生成测试证书链-CloneCert参数能复制现有证书并修改特定属性# 克隆现有证书并延长有效期 $newCert New-SelfSignedCertificate -CloneCert $rootCert -NotAfter (Get-Date).AddYears(5) -Subject CNIntermediate CA 1 -TextExtension (2.5.29.19{text}CAtruepathlength2) # 查看克隆证书的指纹差异 $rootCert.Thumbprint $newCert.Thumbprint典型克隆场景创建多级证书链批量生成测试用终端实体证书复制证书模板调整密钥用法证书生命周期管理实战技巧自动续期监控# 检查30天内过期的证书 Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.NotAfter -lt (Get-Date).AddDays(30) } | Select-Object Subject,Thumbprint,NotAfter私钥备份策略$backupParams { Cert Get-ChildItem Cert:\CurrentUser\My\THUMBPRINT_HERE FilePath C:\Backups\CertBackup.pfx Password (Read-Host -AsSecureString -Prompt Enter backup password) IncludeAllExtendedProperties $true } Export-PfxCertificate backupParams证书吊销检查$cert Get-ChildItem Cert:\LocalMachine\My\THUMBPRINT_HERE $chain New-Object System.Security.Cryptography.X509Certificates.X509Chain $chain.Build($cert) | Out-Null $chain.ChainStatus | Where-Object { $_.Status -ne NoError }在Active Directory环境中这些技术可以结合组策略自动部署证书到域成员计算机。例如通过certutil -pulse命令触发自动注册策略或使用PSPKI模块进行更精细的证书模板管理。