IAM in Service Catalog
This page describes how to obtain a certificate on Windows Server 2008 R2 or 2012 without using IIS Manager. The version of certmgr.msc supplied with Windows 2003 is different and these instructions do not apply.
Step 16 17 of this document will generate a Certificate Signing Request (CSR) that allows the private key to be exported. Sometimes this is required because the certificate will be used on multiple hosts (clustering environment) or the application that will use the certificate can't access the Windows certificate store. CSRs with exportable keys cannot be generated from IIS Manager–you must use the Windows certificate manager.