[Version]
Signature = "$Windows NT$"

[Strings]
szOID_ENHANCED_KEY_USAGE = "2.5.29.37"
szOID_DOCUMENT_ENCRYPTION = "1.3.6.1.4.1.311.80.1"

[NewRequest]
Subject = "cn=protect@cmsmessage"
MachineKeySet = false
KeyLength = 2048
KeySpec = AT_KEYEXCHANGE
HashAlgorithm = Sha1
Exportable = true
RequestType = Cert
KeyUsage = "CERT_KEY_ENCIPHERMENT_KEY_USAGE | CERT_DATA_ENCIPHERMENT_KEY_USAGE"
ValidityPeriod = "Years"
ValidityPeriodUnits = "1000"

[Extensions]
%szOID_ENHANCED_KEY_USAGE% = "{text}%szOID_DOCUMENT_ENCRYPTION%"

# Your tenant name (can something more descriptive as well)
$TenantName        = "svc-db02-pwsh@local"

# Where to export the certificate without the private key
$CerOutputPath     = "{0}\svc-db02-pwsh@local.cer" -f (Split-Path $MyInvocation.MyCommand.Source)

# What cert store you want it to be in
$StoreLocation     = "Cert:\CurrentUser\My"

# Expiration date of the new certificate
$ExpirationDate    = (Get-Date).AddYears(50)


# Splat for readability
$CreateCertificateSplat = @{
    FriendlyName      = "for Encrypt CMS Data"
    DnsName           = $TenantName
    CertStoreLocation = $StoreLocation
    NotAfter          = $ExpirationDate
    Type = 'DocumentEncryptionCert'
    KeyExportPolicy   = "Exportable"
    KeyUsage = @('KeyEncipherment','DataEncipherment','KeyAgreement')
    KeySpec           = "Signature"
    Provider          = "Microsoft Enhanced RSA and AES Cryptographic Provider"
    HashAlgorithm     = "SHA256"
}

$certSplat = @{
  DnsName = 'DocEncCert'
  KeyUsage = @('KeyEncipherment','DataEncipherment','KeyAgreement')
  Type = 'DocumentEncryptionCert'
  CertStoreLocation = 'Cert:\\CurrentUser\\My'
  NotAfter = (Get-Date).AddYears(2)
}
# Create the self-signed document encryption certificate
$cert = New-SelfSignedCertificate @certSplat

   KeySpec           = "Signature"