如何找到并使用makecert.exe

如果安装visual studio 后，visual studio command  仍然无法识别 makecert.exe 命令。

则需要手动安装 Windows Software Development Kit (SDK) 。

安装后，在下列文件夹中可以找到相关exe。

C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x64

下面是一些例子：

makecert -r -pe -n "CN=HOSTNAME" -eku 1.3.6.1.5.5.7.3.1 -sky exchange -sv HOSTNAME.pvk HOSTNAME.cer

pvk2pfx -pvk HOSTNAME.pvk -spc HOSTNAME.cer -pfx HOSTNAME.pfx

Other examples:

1. Creates a root certificate with exportable key and places it into the Trusted root auth store of the local computer:
   makecert.exe -r -n "CN=SIL Root Cert" -pe -sr localmachine -ss AuthRoot -len 2048 -sky exchange -m 36
2. Creates a Server SSL certificate based on the above Root cert and places it into the local computers personal store:
   makecert.exe -n "CN=SILAggregator" -in "SIL Root Cert" -eku 1.3.6.1.5.5.7.3.1 -ir localmachine -is AuthRoot -pe -sr localmachine -ss My -len 2048 -sky exchange -m 36
3. Creates a Client Auth certificate:
   makecert.exe -n "CN=SILClientAuth" -in "SIL Root Cert" -eku 1.3.6.1.5.5.7.3.2 -ir localmachine -is AuthRoot -pe -sr localmachine -ss My -len 2048 -sky exchange -m 36
4. Remote Desktop Gateway Sample:
   a) Creates a root certificate with exportable key and places it into the Trusted root auth store of the local computer:
   makecert.exe -r -n "CN=RootCA.mydomain.xxx" -pe -sr localmachine -ss AuthRoot -len 4096 -sky exchange -m 96 -a sha256
   b) Creates the RDG Server SSL Server certificate based on the above Root cert and places it into the local computers personal store:
   makecert.exe -n "CN=rdg.mydomain.xxx" -in "RootCA.mydomain.xxx" -eku 1.3.6.1.5.5.7.3.1 -ir localmachine -is AuthRoot -pe -sr localmachine -ss My -len 2048 -sky exchange -m 36 -a sha256
   c) Use MMC -> Certificates -> Local Computer -> Personal -> select rdg.mydomain.xxx -> Export -> include private key extended key usage and all certificates in hierarchy -> save as .pfx -> bring to RDG -> import -> In RDG manager -> bind SSL new cert.
   d) Use MMC -> Certificates -> Local Computer -> Trusted Root Certification Authorities -> select RootCA.mydomain.xxx-> Export -> No, do not export private key -> save as .cer -> bring to RDP Client -> import .cer to Trusted Root Certification Authorities -> retry RDP connection.