Skip to main content

How to Create a Self-Signed Certificate in Batch Script

For development environments, testing internal web servers, or securing local communication between machines, you don't always need a paid certificate from an external authority like DigiCert or GoDaddy. You can act as your own authority by creating a Self-Signed Certificate. While browsers will show a "Privacy Warning" for self-signed certs (until you manually trust them), they still provide full encryption for your data. A Batch script can use a PowerShell bridge or the built-in New-SelfSignedCertificate cmdlet to instantly generate a professional-grade certificate with a specific expiration date and subject name.

This guide will explain how to programmatically generate your own SSL/TLS certificates.

Method: The PowerShell Bridge (Most Robust)​

Modern Windows 10 and 11 computers have a powerful built-in cmdlet for certificate generation. We can call it directly from a Batch script.

@echo off
set "DnsName=LocalDevServer"
set "CertStore=Cert:\LocalMachine\My"

echo [ACTION] Generating Self-Signed Certificate for %DnsName%...

:: Use PowerShell to create the certificate
:: -DnsName = The domain name (e.g., localhost)
:: -CertStoreLocation = Where to save it
powershell -NoProfile -Command ^
    "try {" ^
    "  $cert = New-SelfSignedCertificate -DnsName '%DnsName%' -CertStoreLocation '%CertStore%';" ^
    "  Write-Host '[SUCCESS] Certificate created and saved to the Personal (My) store.';" ^
    "  Write-Host 'Subject:' $cert.Subject;" ^
    "  Write-Host 'Thumbprint:' $cert.Thumbprint;" ^
    "  Write-Host 'Expires:' $cert.NotAfter" ^
    "} catch { Write-Host '[ERROR]' $_.Exception.Message; exit 1 }"

if %errorlevel% neq 0 (
    echo [ERROR] Generation failed. Ensure you are running as ADMIN.
)

pause
warning

Administrative Rights. Creating certificates in the LocalMachine store requires high-level system permissions. You MUST run your script as an Administrator.

Method 2: Generating a Certificate that Lasts 10 Years​

By default, self-signed certs only last one year. You can customize the lifespan.

@echo off
echo [ACTION] Creating 10-Year Certificate...

powershell -NoProfile -Command ^
    "try {" ^
    "  $cert = New-SelfSignedCertificate -DnsName 'LongLifeServer'" ^
    "    -CertStoreLocation 'Cert:\LocalMachine\My'" ^
    "    -NotAfter (Get-Date).AddYears(10);" ^
    "  Write-Host '[SUCCESS] Certificate created. Expires:' $cert.NotAfter" ^
    "} catch { Write-Host '[ERROR]' $_.Exception.Message; exit 1 }"

if %errorlevel% neq 0 (
    echo [ERROR] Generation failed. Ensure you are running as ADMIN.
)

pause

Method 3: Exporting the New Certificate to a File​

Once created, you often need to save it as a .cer file to share with your other computers.

@echo off
set "SubjectName=MyService"
set "OutDir=C:\Temp"
set "OutFile=%OutDir%\MyCert.cer"

echo [EXPORT] Saving certificate to file...

:: Ensure the output directory exists
if not exist "%OutDir%" mkdir "%OutDir%"

powershell -NoProfile -Command ^
    "$cert = Get-ChildItem Cert:\LocalMachine\My |" ^
    "  Where-Object { $_.Subject -like '*%SubjectName%*' } |" ^
    "  Sort-Object NotBefore -Descending |" ^
    "  Select-Object -First 1;" ^
    "if (-not $cert) { Write-Host '[ERROR] No certificate found matching: %SubjectName%'; exit 1 };" ^
    "Export-Certificate -Cert $cert -FilePath '%OutFile%';" ^
    "Write-Host '[DONE] Exported:' $cert.Subject;" ^
    "Write-Host 'File saved to: %OutFile%'"

if %errorlevel% neq 0 (
    echo [ERROR] Export failed. Ensure the certificate exists and you are running as ADMIN.
)

pause

How to Avoid Common Errors​

Wrong Way: Thinking a Self-Signed cert is "Insecure"​

A self-signed certificate provides the exact same encryption strength as a $500 certificate. The only difference is "Trust."

Correct Way: Use self-signed certs for internal tools and labs. Never use them for public-facing websites where your customers will see intimidating "Dangerous Site" warnings.

Problem: Browser Warnings​

Chrome and Edge will block a self-signed site by default.

Solution: You must take the exported .cer (Method 3) and import it into the Trusted Root Certification Authorities store on every machine that needs to visit the site. Once imported, the warning will disappear.

Best Practices and Rules​

1. Match the DNS Name​

The DnsName you use (e.g., local.test) MUST match the URL you type into your browser. If you create a cert for ServerA but visit https://192.168.1.5, the browser will still show a "Name Mismatch" error.

2. Identify "Key Usage"​

If you are using the certificate for something specific like "Code Signing" or "Client Auth," you must add the -KeyUsage and -TextExtension parameters in your PowerShell command so Windows knows what the certificate is for.

3. Cleanup Old Certs​

Self-signed certs are "Cheap" to create, so developers often end up with fifty of them. Always use a descriptive FriendlyName parameter (e.g., -FriendlyName 'Dev Test 2024') so you can identify and delete old test certificates during your cleanup scripts.

Conclusions​

Creating self-signed certificates via Batch script is a vital skill for anyone building or testing secure Windows services. By moving from manual wizard-based creation to automated generation, you gain the ability to spin up encrypted environments in seconds. This professional capability ensures that your development labs and internal tools remain secure, encrypted, and ready for high-integrity communication without the cost or complexity of external authorities.

Table of Contents