Windows 11中New-SelfSignedCertificate参数报错问题求助

问题重现 #

执行以下命令时遭遇两个连续错误：

$params = @{
    Type = 'Custom'
    Subject = 'E=patti.fuller@contoso.com,CN=Patti Fuller'
    TextExtension = @(
        '2.5.29.37={text}1.3.6.1.5.5.7.3.4',
        '2.5.29.17={text}email=patti.fuller@contoso.com&upn=pattifuller@contoso.com' )
    KeyAlgorithm = 'RSA'
    KeyLength = 2048
    SmimeCapabilities = $true
    CertStoreLocation = 'Cert:\CurrentUser\My'
}
New-SelfSignedCertificate @params

第一个错误：

New-SelfSignedCertificate : Parameter cannot be processed because the parameter name 'Subject' is ambiguous. Possible matches include: -SubjectName -SubjectAlternative.

将Subject改为SubjectName后出现第二个错误：

New-SelfSignedCertificate : Cannot validate argument on parameter 'SubjectName'. The argument "E=patti.fuller@contoso.com,CN=Patti Fuller" does not match the "^{(CN|E|O|OU|C|ST|L):[},:]+$" pattern. Supply an argument that matches "^{(CN|E|O|OU|C|ST|L):[},:]+$" and try the command again.

解决方案 #

方案1：使用X500DistinguishedName对象传递多属性主题 #

通过构造X500DistinguishedName对象绕过字符串格式验证，同时保留多属性主题：

# 构造符合X.500规范的主题对象
$subjectName = [System.Security.Cryptography.X509Certificates.X500DistinguishedName]::new("E=patti.fuller@contoso.com,CN=Patti Fuller")

$params = @{
    Type = 'Custom'
    SubjectName = $subjectName
    TextExtension = @(
        '2.5.29.37={text}1.3.6.1.5.5.7.3.4',
        '2.5.29.17={text}email=patti.fuller@contoso.com&upn=pattifuller@contoso.com' )
    KeyAlgorithm = 'RSA'
    KeyLength = 2048
    SmimeCapabilities = $true
    CertStoreLocation = 'Cert:\CurrentUser\My'
}
New-SelfSignedCertificate @params

方案2：拆分主题与SAN扩展 #

将主题简化为单个属性（如CN），并将邮箱信息保留在Subject Alternative Name扩展中（原命令已包含该配置）：

$params = @{
    Type = 'Custom'
    SubjectName = 'CN=Patti Fuller'
    TextExtension = @(
        '2.5.29.37={text}1.3.6.1.5.5.7.3.4',
        '2.5.29.17={text}email=patti.fuller@contoso.com&upn=pattifuller@contoso.com' )
    KeyAlgorithm = 'RSA'
    KeyLength = 2048
    SmimeCapabilities = $true
    CertStoreLocation = 'Cert:\CurrentUser\My'
}
New-SelfSignedCertificate @params

原因说明 #

• 参数歧义错误：Windows 11自带的PKI模块已弃用原Subject参数，拆分出SubjectName（证书主题）和SubjectAlternativeName（备用名称扩展），因此必须明确使用SubjectName。
• 格式验证错误：该版本对SubjectName的字符串参数添加了严格正则验证，仅允许单个属性；使用X500DistinguishedName对象是符合X.500规范的标准写法，可绕过此验证并支持多属性主题。

内容的提问来源于stack exchange，提问作者Przemekeke