PowerShell Script to Create Self-Signed Certificate for Entra App Registration

# ===== Generate PFX/CER and PEMs for Entra App Registration =====
# Compatible with Windows PowerShell 5.1 and PowerShell 7 (Windows)

# --- Hardcoded settings
$OutDir      = "C:\Secure\Certs"
$SubjectCN   = "PnP-App-registration"
$YearsValid  = 10
$PfxPassword = "ChangeMeBeforeUse!"

if ([string]::IsNullOrWhiteSpace($PfxPassword)) {
    throw "Set a non-empty PFX password before running this script."
}

if (-not $IsWindows -and $PSVersionTable.PSVersion.Major -ge 6) {
    throw "This script uses New-SelfSignedCertificate, which requires Windows."
}

# --- Prep output
if (-not (Test-Path $OutDir)) {
    New-Item -ItemType Directory -Path $OutDir -Force | Out-Null
}

$pfxPath     = Join-Path $OutDir "pnp-apponly.pfx"
$cerPath     = Join-Path $OutDir "pnp-apponly.cer"
$certPemPath = Join-Path $OutDir "cert.pem"
$keyPemPath  = Join-Path $OutDir "key.pem"
$combinedPem = Join-Path $OutDir "combined.pem"

function To-PemBlock {
    param(
        [Parameter(Mandatory)][string]$Label,
        [Parameter(Mandatory)][byte[]]$Bytes
    )
    $b64 = [Convert]::ToBase64String($Bytes, [System.Base64FormattingOptions]::InsertLineBreaks)
    return "-----BEGIN $Label-----`n$b64`n-----END $Label-----`n"
}

function Get-PrivateKeyPem {
    param([Parameter(Mandatory)]$Certificate)

    $rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($Certificate)
    $ecdsa = $null
    if (-not $rsa) {
        $ecdsa = [System.Security.Cryptography.X509Certificates.ECDsaCertificateExtensions]::GetECDsaPrivateKey($Certificate)
    }

    if ($rsa) {
        if ($rsa.GetType().GetMethod("ExportPkcs8PrivateKey")) {
            return To-PemBlock -Label "PRIVATE KEY" -Bytes ($rsa.ExportPkcs8PrivateKey())
        }
        if ($rsa.GetType().GetMethod("ExportRSAPrivateKey")) {
            return To-PemBlock -Label "RSA PRIVATE KEY" -Bytes ($rsa.ExportRSAPrivateKey())
        }
        return $null   # .NET Framework (Windows PowerShell 5.1): no managed key export
    }

    if ($ecdsa) {
        if ($ecdsa.GetType().GetMethod("ExportPkcs8PrivateKey")) {
            return To-PemBlock -Label "PRIVATE KEY" -Bytes ($ecdsa.ExportPkcs8PrivateKey())
        }
        if ($ecdsa.GetType().GetMethod("ExportECPrivateKey")) {
            return To-PemBlock -Label "EC PRIVATE KEY" -Bytes ($ecdsa.ExportECPrivateKey())
        }
        return $null
    }

    return $null
}

# --- Create self-signed certificate (CurrentUser\My)
$notAfter = (Get-Date).AddYears($YearsValid)
$cert = New-SelfSignedCertificate `
    -Subject "CN=$SubjectCN" `
    -KeyAlgorithm RSA -KeyLength 3072 `
    -KeyExportPolicy Exportable `
    -KeyUsage DigitalSignature, KeyEncipherment `
    -Provider "Microsoft Enhanced RSA and AES Cryptographic Provider" `
    -CertStoreLocation "Cert:\CurrentUser\My" `
    -NotAfter $notAfter `
    -HashAlgorithm SHA256

if (-not $cert) {
    throw "Failed to create self-signed certificate."
}
Write-Host "Created cert. Thumbprint: $($cert.Thumbprint)" -ForegroundColor Green

# --- Export PFX & CER
$secPwd = ConvertTo-SecureString -String $PfxPassword -AsPlainText -Force
Export-PfxCertificate -Cert $cert -FilePath $pfxPath -Password $secPwd -Force | Out-Null
Export-Certificate -Cert $cert -FilePath $cerPath -Force | Out-Null
Write-Host "Exported PFX: $pfxPath" -ForegroundColor Cyan
Write-Host "Exported CER: $cerPath" -ForegroundColor Cyan

# --- Reopen PFX with private key (exportable) for PEM creation
$pfxBytes = [IO.File]::ReadAllBytes($pfxPath)
$x509 = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new(
    $pfxBytes,
    $PfxPassword,
    [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable
)

# --- cert.pem (certificate)
$derCert = $x509.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Cert)
$certPem = To-PemBlock -Label "CERTIFICATE" -Bytes $derCert
[IO.File]::WriteAllText($certPemPath, $certPem, [Text.Encoding]::ASCII)
Write-Host "Exported cert.pem" -ForegroundColor Cyan

# --- key.pem (private key)
# Native managed export works on PowerShell 7+. Windows PowerShell 5.1
# (.NET Framework) cannot export the key in managed code, so it falls back
# to OpenSSL when available; otherwise key.pem is skipped (PFX/CER are all
# Entra needs).
$keyPem = Get-PrivateKeyPem -Certificate $x509

if ($keyPem) {
    [IO.File]::WriteAllText($keyPemPath, $keyPem, [Text.Encoding]::ASCII)
}
elseif (Get-Command openssl -ErrorAction SilentlyContinue) {
    Write-Host "Using OpenSSL fallback for key.pem (PowerShell 5.1)..." -ForegroundColor Yellow
    & openssl pkcs12 -in $pfxPath -nocerts -nodes -out $keyPemPath -passin "pass:$PfxPassword" 2>$null
    if (-not (Test-Path $keyPemPath)) {
        # OpenSSL 3.x often needs -legacy for a Windows-exported PFX
        & openssl pkcs12 -in $pfxPath -nocerts -nodes -legacy -out $keyPemPath -passin "pass:$PfxPassword" 2>$null
    }
}

if (Test-Path $keyPemPath) {
    Write-Host "Exported key.pem" -ForegroundColor Cyan

    # --- combined.pem (cert + key)
    $keyPemText = Get-Content -Raw -Path $keyPemPath
    [IO.File]::WriteAllText($combinedPem, ($certPem + $keyPemText), [Text.Encoding]::ASCII)
    Write-Host "Exported combined.pem" -ForegroundColor Cyan
}
else {
    Write-Warning "key.pem/combined.pem skipped. Run on PowerShell 7 or install OpenSSL to generate PEM private keys. PFX and CER are ready for Entra."
}

# --- Summary
Write-Host "`n==== Summary ====" -ForegroundColor Yellow
Write-Host ("PFX:      {0}" -f $pfxPath)
Write-Host ("CER:      {0}" -f $cerPath)
Write-Host ("cert.pem: {0}" -f $certPemPath)
if (Test-Path $keyPemPath)  { Write-Host ("key.pem:  {0}" -f $keyPemPath) }
if (Test-Path $combinedPem) { Write-Host ("combined: {0}" -f $combinedPem) }
Write-Host ("Thumbprint: {0}" -f $cert.Thumbprint)
Write-Host ("Subject:  {0}" -f $SubjectCN)
Write-Host ("Valid to: {0:yyyy-MM-dd}" -f $notAfter)

$pfxPath = "C:\Secure\Certs\pnp-apponly.pfx"
$pfxPassword = ConvertTo-SecureString -String "ChangeMeBeforeUse!" -AsPlainText -Force

Import-PfxCertificate `
  -FilePath $pfxPath `
  -CertStoreLocation "Cert:\CurrentUser\My" `
  -Password $pfxPassword | Out-Null

# Verify it exists
Get-ChildItem "Cert:\CurrentUser\My" |
  Where-Object Subject -like "*PnP-App-registration*" |
  Select-Object Subject, Thumbprint, NotAfter

$cert = Get-ChildItem "Cert:\CurrentUser\My" |
  Where-Object Subject -like "*PnP-App-registration*" |
  Sort-Object NotAfter -Descending |
  Select-Object -First 1

$cert.Thumbprint

$pfxPassword = ConvertTo-SecureString -String "ChangeMeBeforeUse!" -AsPlainText -Force

Connect-PnPOnline `
  -Url "https://contoso.sharepoint.com" `
  -ClientId "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" `
  -Tenant "contoso.onmicrosoft.com" `
  -CertificatePath "C:\Secure\Certs\pnp-apponly.pfx" `
  -CertificatePassword $pfxPassword

Connect-PnPOnline `
  -Url "https://contoso.sharepoint.com" `
  -ClientId "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" `
  -Tenant "contoso.onmicrosoft.com" `
  -Thumbprint "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

$pfxPassword = ConvertTo-SecureString -String "ChangeMeBeforeUse!" -AsPlainText -Force

Connect-PnPOnline `
  -Url "https://contoso.sharepoint.com" `
  -ClientId "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" `
  -Tenant "contoso.onmicrosoft.com" `
  -CertificatePath "C:\Secure\Certs\pnp-apponly.pfx" `
  -CertificatePassword $pfxPassword