使用PowerShell生成2048位自签名证书的公钥长度问题排查

阿华AIGC实验室

2026-5-15

解决自签名证书公钥长度仍为1024位的问题

我之前也碰到过一模一样的情况——明明在代码里设置了$key.Length = 2048，但生成的证书公钥还是1024位。问题根源出在你使用的**传统加密服务提供商(CSP)**上。

"Microsoft RSA SChannel Cryptographic Provider"是旧版的CSP，它对密钥长度的配置支持存在局限性，即使你明确指定了2048位，它还是会默认生成1024位的密钥。解决方法是改用现代的CNG（Cryptography Next Generation）提供商，同时调整几个关键参数：

修改后的完整函数代码

function Add-SelfSignedCertificate {
    [CmdletBinding()]
    param (
        [Parameter(Mandatory=$True, ValueFromPipelineByPropertyName=$True)]
        [Alias('cn')]
        [string]$CommonName
    )
    $name = new-object -com "X509Enrollment.CX500DistinguishedName.1"
    $name.Encode("CN=$CommonName", 0)
    
    $key = new-object -com "X509Enrollment.CX509PrivateKey.1"
    # 改用CNG提供商
    $key.ProviderName = "Microsoft Software Key Storage Provider"
    # CNG不需要指定KeySpec为1，0表示无特定用途，自动适配
    $key.KeySpec = 0
    $key.Length = 2048
    $key.SecurityDescriptor = "D:PAI(A;;0xd01f01ff;;;SY)(A;;0xd01f01ff;;;BA)(A;;0x80120089;;;NS)"
    $key.MachineContext = 1
    $key.Create()
    
    $serverauthoid = new-object -com "X509Enrollment.CObjectId.1"
    $serverauthoid.InitializeFromValue("1.3.6.1.5.5.7.3.1")
    $ekuoids = new-object -com "X509Enrollment.CObjectIds.1"
    $ekuoids.add($serverauthoid)
    $ekuext = new-object -com "X509Enrollment.CX509ExtensionEnhancedKeyUsage.1"
    $ekuext.InitializeEncode($ekuoids)
    
    $cert = new-object -com "X509Enrollment.CX509CertificateRequestCertificate.1"
    $cert.InitializeFromPrivateKey(2, $key, "")
    $cert.Subject = $name
    $cert.Issuer = $cert.Subject
    $cert.NotBefore = get-date
    $cert.NotAfter = $cert.NotBefore.AddYears(5)
    $cert.X509Extensions.Add($ekuext)
    $cert.Encode()
    
    $enrollment = new-object -com "X509Enrollment.CX509Enrollment.1"
    $enrollment.InitializeFromRequest($cert)
    $enrollment.CertificateFriendlyName = $CommonName
    $certdata = $enrollment.CreateRequest(0)
    $enrollment.InstallResponse(2, $certdata, 0, "")
}

关键改动说明

更换加密提供商：把$key.ProviderName改为"Microsoft Software Key Storage Provider"，这是微软推荐的现代CNG提供商，对密钥长度的配置支持更可靠。
调整KeySpec参数：CNG提供商不需要指定KeySpec = 1（这是旧CSP用于签名/加密的标识），改为0表示无特定用途，会自动适配证书的使用场景。
保留长度设置：你原来的$key.Length = 2048设置是正确的，更换提供商后这个值会被正确应用。