richiesta certificato per server nps

se devo generare un certificato per server nps senza avere a disposizione una enterprise ca ( quindi senza la possibilità di usare un template di certificato) posso usare questo script:

create un file di testo e nominarlo in c:\CA\cert.inf

[Version]
Signature="$Windows NT$
[NewRequest]
Subject = "CN=domaincontroller.domain.com" ; must be the FQDN of domain controller
; EncipherOnly = FALSE - This is only for Windows 2008 server on Windows 2003 remove ;
Exportable = FALSE  ; TRUE = Private key is exportable
KeyLength = 2048
KeySpec = 1             ; Key Exchange
KeyUsage = 0xA0     ; Digital Signature, Key Encipherment
MachineKeySet = True
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = CMC
[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1
OID=1.3.6.1.5.5.7.3.2


eseguire lo script:

##Run the next command##

C:\CA>certreq -new cert.inf request.req

CertReq: Request Created

##Open Certificate Authority##

1. Go to pending requests and issue the certificate.
2. Open the issued certificate --> Go to details --> Copy to a file --> Save it to c:\CA\server auth cert.cer

##Accept the certificate##

C:\CA>certreq -accept "server auth.cer"

##Open Certificates MMC console##

Go to Personal --> Certificates --> find the certificate and see if it has server authontication and client authontication is there.