This page describes how to obtain a certificate on Windows Server 2008 R2 or 2012 without using IIS Manager. The version of certmgr.msc supplied with Windows 2003 is different and these instructions do not apply.
Step 16 17 of this document will generate a Certificate Signing Request (CSR) that allows the private key to be exported. Sometimes this is required because the certificate will be used on multiple hosts (clustering environment) or the application that will use the certificate can't access the Windows certificate store. CSRs with exportable keys cannot be generated from IIS Manager–you must use the Windows certificate manager.
- Log in as an administrator
- From a command prompt or the run menu:
- To create the certificate in the local machine store (recommended):
- Type mmc
- On the File menu, click Add/Remove Snap-in. Click Certificates in the left pane, then click Add.
- Select Computer Account, then click Next.
- Select Local Computer, then click Finish.
- Click OK.
- To create the certificate in the logged on user's personal store:
- Type certmgr.msc
- In the left pane expand Certificates (Local Computer), expand Personal, then click Certificates.
- On the Action menu, click All Tasks, then click Advanced Operations, then click Create Custom Request.
- Click Next.
- Select Proceed without enrollment policy. Click Next.
- In the Template menu, select (No template) CNG key, and verify that Suppress default extensions is not selected. (Note: Some legacy software may not be compatible with CNG keys. In this case, select (No template) Legacy key )(Note: specifically, the .Net X509Certificate2.PrivateKey method will throw an exception on CNG keys and ADFS 3.0 will refuse to accept them.)
- Under Request Format, select PKCS #10. Click Next.
- Click the arrow next to Details to expand the selection. Click Properties.
- On the General tab, provide a Friendly name and Description for the certificate. These can be anything you want.
- On the Subject tab, in the Subject name box:
- In the Type menu, select Common name. In the Value field, type the fully qualified domain name of the server (e.g. myhost.washington.edu), and click Add.
- In the Type menu, select Organization. In the Value field, type University of Washington. Click Add.
- In the Type menu, select State. In the Value field, type WA. Click Add.
- In the Type menu, select Country. In the Value field, type US. Click Add.
- (Optional) In the Type menu, select Email. In the Value field, type a contact email address. Click Add.
- (Optional) On the Subject tab, in the Alternative name box, enter subject alternative names if you need them (these can also be requested when you submit the CSR).
- (Optional) If you want to restrict how this certificate can be used, you can select the appropriate options under Key usage and Extended Key Usage on the Extensions tab.
- On the Private Key tab, expand Cryptographic Service Provider. Select RSA, Microsoft Software Key Storage Provider. Make sure no other options are selected. (Note: If you selected (No template) Legacy key in Step 7, select Microsoft RSA SChannel Crytographic Provider (Encryption) instead. This option is usually at the end of the list. ).
- On the Private Key tab, expand Key Options.
- In the Key size menu, select a value of at least 2048.
- Select Make private key exportable. This step is only required if you will use this certificate on another computer (e.g. in a clustered environment), or with an application that does not use the Windows certificate store (e.g. Mozilla Firefox).
- Click OK.
- Click Next.
- Choose a file name and location for the CSR. Select Base 64. Click Finish.
- Submit the CSR to the InCommon or UW CA. For details on this process see UW Certificate Services.