Creating & Setting-up Self Signed Certificate on Endpoint

About this task

Use this task to generate and configure a self-signed code-signing certificate on the endpoint for use with Windows Defender Application Control (WDAC).
The task performs the following:
  • Creates the following required BAC directories if they do not exist:
    • BAC\Certs
    • BAC\Logs
  • Generates a self-signed code-signing certificate with:
    • RSA 4096-bit key
    • SHA256 hashing
    • Digital Signature usage
    • Validity based on user input
  • Stores the certificate at the Cert:\LocalMachine\My location.
  • Exports the public certificate to the BAC\Certs\WDAC_SigningCert.cer folder.
  • Logs errors (if any) to the BAC\Logs\Create_WDAC_SigningCert.log location.
Refer to the table below to know more about the task's exit code.
Table 1. Exit Codes Table
Exit Code Meaning
0 Success
10 BAC directory creation failure
11 Certificate directory creation failure
12 Log directory creation failure
20 Certificate creation failure
30 Certificate export failure
Figure 1. Task: Setup and Create Self-Signed Certificate

Setup and Create Self-Signed Certificate on Endpoint v2.0

Procedure

  1. In the BigFix Console, navigate to All Content > BigFix Application Control > Fixlets and Tasks.
  2. From the Fixlets and Tasks pane, select Task: Setup and Create Self-Signed Certificate on Endpoint v2.0.
  3. From the Task: Setup and Create Self-Signed Certificate on Endpoint v2.0 pane, under Configuration Options, enter the following information:


    Table 2. Task: Setup and Create Self-Signed Certificate on Endpoint v2.0 Configuration Options
    Field Name Description
    Certificate Validity (Years) Number of years for which the newly generated certificate will be valid.
  4. From the Task: Setup and Create Self-Signed Certificate on Endpoint v2.0 pane, click the Applicable Computers(n) tab and view the endpoints on which you want to run the task.
  5. Select the Take Actions tab and select the endpoints on which you want to apply this installer task.
  6. Click OK.

Results

A successful execution of this task results in the following outcomes:
  • A self-signed WDAC certificate is created on the endpoint.
  • The certificate is available in the LocalMachine store.
  • The public certificate is exported to the BAC folder.
  • A certificate is ready for WDAC policy signing and deployment.