If the selected CA provides instructions or utilities to generate CSRs using Microsoft tools, those can be used in preference to the following steps providing the correct format and content result. Any question on format or content should be clarified with the CA.
The following step cover use of the Microsoft Management Console Certificates Snap-in to generate a CSR and process the signed identity certificate. The identity certificate will reside in the Local Machine Personal certificate store and will not active on any machine interface by default.
All steps must be carefully followed to avoid errors.
Further information on the snap-in and certificate operations can be found at: https://technet.microsoft.com/en-us/library/cc771157.aspx
Ensure all naming information has been identified (Common name, Alternate subject names, organization details and so on).
You must be logged in and run the console session as administrator.
To open the Microsoft Management Console (MMC):
Click Start.
In the Search box, type mmc.
Click mmc.exe.
Click .
Click .
Select and click .
Select Local Computer and click Finish then OK.
Expand Certificates (Local Computer).
Right-click Personal, then click .
Click Next.
Select Proceed without enrollment policy and click Next.
Select (No Template) Legacy Key.
Select PKCS #10 and click Next.
In the Certificate Information section, click arrow button next to Details and click Properties.
On the General tab, type the domain name of the certificate in the Friendly Name field.
On the Subject tab, in the Subject Name field, enter the information below, clicking Add after entering each type:
Type |
Value |
Notes |
Country |
Country Name (2 letter code) |
The Country Name is a 2 letter code defined by https://www.iso.org/obp/ui/#home; select Country codes, and click search. For example, US |
State |
State or Province name |
Do not abbreviate |
Locality |
Locality name |
For example, City |
Organization |
Organization name |
For example, Company Name |
Organization Unit |
Section/Department name |
For example, IT |
Common Name |
FQDN of server |
For example, www.example.com |
Email |
Contact email address |
For example, contact@example.com |
Any entries not required (for example Organizational Unit Name) or not requested by the CA should not be added.
If the CSR is for a multi-domain/SAN certificate, in the Alternative Name field, enter the information below, clicking Add after entering each type:
Type |
Value |
Notes |
DNS |
DNS SAN entry |
The first Alternative Name field should be DNS with the same value as the Common Name. |
URL |
URI SAN entry |
For example: sip:example.com |
IP address (v4) |
IP SAN entry |
For example: 192.168.0.42 IP address entries are not recommended. |
On the Extension tab, select Key usage.
Select Non repudiation, Digital signature, Key encipherment, and Data encipherment, clicking Add after entering each option.
Unselect Make these key usages critical.
On the Extension tab, select Extended Key Usage.
Select Server Authentication and Client Authentication, clicking Add after entering each option.
Unselect Make the Extended Key Usage critical.
On the Private Key tab, select Cryptographic Service Provider, select Microsoft Strong Cryptographic Provider (Encryption) only.
On the Private Key tab, select Key type, select Exchange.
On the Private Key tab, select and set the value to 2048.
Select Make Private Key Exportable. Note: This step is important.
If presented, select Select Hash Algorithm, select Hash Algorithm and set the value to sha256.
Review all entries; check the is still set to the value to 2048.
Click OK then Next.
Enter the filename (for example, yourdomain) and location to save the CSR to. Ensure Base 64 is selected. Click Finish.
Open the CSR file yourdomain.req in a text editor and copy all of the text, including the start and end lines.
Go to the CA and follow instruction to paste the full CSR into the SSL enrollment form of the CA. If requested, the server software used to generate the CSR can be specified as Microsoft or Microsoft IIS 7. If requested, SHA-256 should be selected for the hash algorithm. Do not use SHA-1.
