Issuing Web Server / SSL / TLS Certificates From Microsoft CA - custom certificate request

This process uses uses the command line to issue the certificate request to the CA.

Overview

1. Create the Request via IIS Manager. Save as sslCert2.txt

2. Submit using the command: certreq -attrib "CertificateTemplate:webserver" –submit sslCert2.txt

CA Preparation

For the Web Server certificate, the SAN must also be configured.

certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2

Create the request via the command line

1. Open the Certificate MMC, Local Computer

2. Right click on Personal, Select All Tasks, Advanced Operations, Create Custom Request

3. When the certificate enrollment wizard opens, Click Next

4. Highlight, “Configured by you” Custom Request, Proceed without enrollment policy. Press Next

5. For template, select Legacy Key, Request Format, PKCS# 10

6. In custom request, press the down arrow on Details and Press Properties

   

7. In the general tab, enter the friendly name

8. In the subject tab, select common name, and enter the dns name. In the alternative name, select DNS, and enter the dns name.

9. In the Extensions tab, click key usage. Add digital signature, Key encipherment and non repudiation

10. Next, click the Extended Key Usage, Add Server Authentication and Client Authentication

11. Select the Private Key Tab, Key Options, Select 2048, Check Make private key exportable

12. Press Apply, Press OK

13. In the Certificate Enrollment Wizard, Press Next

14. Save the file using Base 64 to c:\temp sslCert.req

15. Go to the command prompt and run: certreq -attrib "CertificateTemplate:webserver" –submit sslCert.req

16. When the Certificate Authority List pops up, select the CA and press OK

17. Save the certificate to c:\temp

18. Go back to the certificate snap in, Local Computer, Personal. Import the certificate that was just created

19. Export the certificate

20. Use IIS manager to import the certificate