This document is deprecated.  Up-to-date instructions are available at:

Obtain a Certificate on Windows Server 2008 R2 and 2012 (Without Using IIS)

Purpose

This page describes how to obtain a certificate on Windows 2008 without using IIS Manager. The instructions have been tested using Windows Server 2008 R2. The version of certmgr.msc supplied with Windows 2003 is different and these instructions do not apply.

Instructions

Generate a new private key and certificate signing request (CSR)

1. Log in as Administrator.
2. Open the Certificate Manager console (click Start > Search programs and files > certmgr.msc).
3. Open your Local Computer certificates (click File > Add/Remove Snap-in... > Certificates > Computer account > Next > Local computer > Finish).
4. Select Certificates (Local Computer) > Personal > Certificates.
5. With the Personal Certificates for the Local Computer highlighted, click Action > All Tasks > Advanced Operations > Create Custom Request. This will open the Certificate Enrollment wizard.
6. In the Certificate Enrollment wizard:
   1. Read the Before You Begin screen and click Next.
   2. On the Select Enrollment Policy screen, under Custom Request, select Proceed without enrollment policy and click Next.
   3. On the Custom request screen
      1. For Template, choose "(No template) Legacy key" from the drop-down menu, and leave "Suppress default extensions" unchecked.
      2. For Request format, select PKCS#10.
      3. Click Next.
   4. On the Certificate Enrollment screen, click Details, then click Properties. This will open a Certificate Properties dialog box.
      1. On the General tab, enter a Friendly name and Description for your certificate.
      2. On the Subject tab
         1. Select Common Name from the Type menu, enter your fully qualified DNS name for the value, and click "Add >".
         2. Select Organization from the Type menu, enter "University of Washington" for the value, and click "Add >".
         3. Select State from the Type menu, enter "WA" for the value, and click "Add >".
         4. Select Country from the Type menu, enter "US" for the value, and click "Add >".
         5. Optionally, select Email from the Type menu, enter an email address for the value, and click "Add >".email.
         6. Optionally, add Subject Alternative name values, if you need them.
      3. On the Extensions tab
         1. Expand "Key usage" and add "Digital signature" to the selected options, and verify that "Make these key usages critical" is checked.
         2. Expand "Extended Key Usage (application policies)" and add "Server Authentication" and "Client Authentication" to the selected options, and verify that "Make the Extended Key Usage critical" is checked.
      4. On the Private Key tab
         1. Expand Cryptographic Service provider and select "Microsoft Strong Cryptographic Provider (Signature)" "Microsoft RSA SChannel Crytographic Provider  (Encryption)".
         2. Expand Key Options and select "2048" from the Key size drop-down menu.
         3. If you will need to export the certificate to use on another host, select "Make private key exportable". This will be important if you have a server cluster or you will be using the new "Central Certificate Store" option available with IIS8.
   5. Click OK.
   6. On the Certificate Information screen, click Next.
      1. Enter a file name for your CSR (e.g. certname.req)
      2. Select "Base 64" as the File Format.
      3. Click Finish.

Submit the CSR and retrieve the certificate

1. Submit the CSR to UW Certificate Services at https://iam-tools.u.washington.edu/cs/
1. Select "New InCommon certificate" if you need an SSL certificate for a web server or other device. Detailed instructions are available.
2. Select "New UWCA certificate" if you need a certificate for client authentication to infrastructure such as web services or directories. Detailed instructions are available.
3. For either set of instructions you will need to paste your CSR into a web form. To do this step, open your CSR file (i.e. certname.req from step 6.f. above) in a text editor, then copy the contents and paste it in the CSR text box on the web form.
2. Retrieving and saving the certificate
1. Once your certificate has been signed you will be notified via email. Follow the link in the email to be directed to your certificate.
2. Click on the "Get PKCS7" button. See note in step #19 of these instructions for help with saving your certificate to a file.
3. Save the file in the same location as your CSR (certname.req). Windows normally uses the .p7b extension for PKCS7 formatted files (i.e. certname.p7b), but you can also use the extensions .cer and .pkcs7.

Import certificate into the certificate store

1. To install the certificate into a service account's certificate store:
   1. Open a command prompt as the service account
   2. Run "certreq -accept -user"
2. To install the certificate into the local machine certificate store:
   1. Open a command prompt as an administrator
   2. Run "certreq -accept -machine"
3. If Windows fails to match the certificate with it's corresponding private key during import, follow these instructions.

See also

• How to Request a Certificate With a Custom Subject Alternative Name (Microsoft)