How to create a web server SSL certificate manually

  • Makale

The Internet Information Server (IIS) and Microsoft Internet Security and Acceleration (ISA) provide wizards in the administration user interface to request and install SSL certificates. With this blog post I want to explain how to request a SSL server certificate manually. The manual steps are required if the Certification Authority (CA) is not available in the same forest as the IIS or ISA is a member of.

1. Creating an INF file to set the certificate properties

Use Notepad to modify the following sample INF file according to your needs. Safe the file as ssl.inf for example

[Version]
Signature="$Windows NT$"

[NewRequest]
Subject = "CN=SERVER.CONTOSO.COM" ; For a wildcard use "CN=*.CONTOSO.COM" for example
; For an empty subject use the following line instead or remove the Subject line entierely
; Subject =
Exportable = FALSE ; Private key is not exportable
KeyLength = 2048 ; Common key sizes: 512, 1024, 2048, 4096, 8192, 16384
KeySpec = 1 ; AT_KEYEXCHANGE
KeyUsage = 0xA0 ; Digital Signature, Key Encipherment
MachineKeySet = True ; The key belongs to the local computer account
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
SMIME = FALSE
RequestType = CMC

; At least certreq.exe shipping with Windows Vista/Server 2008 is required to interpret the [Strings] and [Extensions] sections below

[Strings]
szOID_SUBJECT_ALT_NAME2 = "2.5.29.17"
szOID_ENHANCED_KEY_USAGE = "2.5.29.37"
szOID_PKIX_KP_SERVER_AUTH = "1.3.6.1.5.5.7.3.1"
szOID_PKIX_KP_CLIENT_AUTH = "1.3.6.1.5.5.7.3.2"

[Extensions]
%szOID_SUBJECT_ALT_NAME2% = "{text}dns=computer1.contoso.com&dns=computer2.contoso.com"
%szOID_ENHANCED_KEY_USAGE% = "{text}%szOID_PKIX_KP_SERVER_AUTH%,%szOID_PKIX_KP_CLIENT_AUTH%"

[RequestAttributes]
CertificateTemplate= WebServer

Notes:

  • leave off the Subject= line if you want the subject to be empty
  • if you don’t need the template to be specified, remove the RequestAttributes section
  • the specification of the enhanced key usage OID is not explicitly required since the EKU is defined in the certificate template. The OID in the INF file above is for explanatory purposes
  • you can click on “OK” for the template not found UI from certreq if the client has no access to templates
  • you can ignore the unreferenced “[Strings]” section dialog when it appears

2. Compiling the INF file into a REQ file

The following command-line command will generate key material and turn the INF file into a certificate request.

certreq –new ssl.inf ssl.req

Once the certificate request was created you can verify the request with the following command:

certutil ssl.req

3. Submitting the REQ file to the CA

If the CA is reachable via RPC over the network, use the following command to submit the certificate request to the CA:

certreq –submit ssl.req

You will get a selection dialog to select the CA from. If the CA is configured to issue certificates based on the template settings, the CA may issue the certificate immediately.

If RPC traffic is not allowed between the computer where the certificate request was created and the CA, transfer the certificate request to the CA and perform the above command locally at the CA.

If the certificate template name was not specified in the certificate request above, you can specify it as part of the submission command:

certreq -attrib "CertificateTemplate:webserver" –submit ssl.req

4. Installing the certificate at the IIS or ISA computer

Once the certificate was issued and is available as a file on the target computer, use the following command to install it.

certreq –accept ssl.cer

The installation actually puts the certificate into the computer’s personal store, links it with the key material created in step #1 and builds the certificate property. The certificate property stores information such as the friendly name which is not part of a certificate.

After performing steps 1 to 4 the certificate will show up in the IIS or ISA management interface and can be bound to a web site or a SSL listener.

Comments

  • Anonymous
    January 01, 2003
    This work brilliantly, thanks for taking the time to publish. I managed to create a batch file to automate the whole process via Task Scheduler every 2 years, works a treat. I would like to know how to add a friendly name to the certificate within the ssl.inf file if possible.

  • Anonymous
    January 01, 2003
    Awesome

  • Anonymous
    January 01, 2003
    I am trying to use what you have here to automate the enrollment of certificates for IIS 7.0 under Windows 2008 Server from our AD Certificate Server.  When I use the WebServer template, I am denied permission to submit the certificate. When I use the template name 'Computer' (which matched the template name I see when I create a certificate via the MMC certificate console), I get a 'Template not found' error.  How do I get the template name that is used when I enroll via MMC?

  • Anonymous
    January 01, 2003
    The comment has been removed

  • Anonymous
    January 01, 2003
    Could you please share the INF file that you have used. You only have to change the Subject attribute from the above sample.

  • Anonymous
    January 01, 2003
    The comment has been removed

  • Anonymous
    January 01, 2003
    Rafael, what OS version is the CA running on?

  • Anonymous
    January 01, 2003
    One more question. When I'm creating certificate using Windows Server 2008, could be possible that it is not compatible with windows XP?

  • Anonymous
    January 01, 2003
    The comment has been removed

  • Anonymous
    January 01, 2003
    The "permission denied" problem can be corrected by changing the template permissions with certtempl.msc The "Computer" template is not found if the machine is not connected to the forest where the CA is installed. In this case the error can be ignored unless the name of the template is provided in the certutil -submit command (as explained in step #3

  • Anonymous
    January 01, 2003
    From Windows Server 2008 and on you cannot request computer certificates through the web enrollment pages anymore. See alsotechnet.microsoft.com/.../cc732517(WS.10).aspx and search for "computer certificate"

  • Anonymous
    January 01, 2003
    The [Strings] and [Extensions] sections are NOT understood by the certreq version shipping with Windows XP.

  • Anonymous
    December 24, 2010
    The comment has been removed

  • Anonymous
    December 25, 2010
    I'm running Windows Server 2008 R2 fully updated.... Any ideias? I can request certificates from mmc console -> certificates >request a new certificate.... Recently I installed Lync Server, and had no problem requesting certificates....The problem is only with the web enrollment interface.... I don't know where to look anymore... I'm almost installing a now CA on my environment just to request this certificate.... Any ideias??? Tks for your help...

  • Anonymous
    December 26, 2010
    I know it's a different topic, but the issue is related....Let me explain what I'm trying to do. I'm trying to create a certificate for exchange server 2010 outlook anywhere. I create de .req file on EMC and try to submit it using the certification authority on administrative tools, submit new request, i select the .req file created using exchange emc, but nothing happens. Nothing appears on "Pending requests"  or "failed requests".... When I go to MMC, Certificates, Computer certificates, and request a certificate from there, It works, I add a service for the certificate, in this case, iis since i'm trying to get outlook anywhere to work, and the certificate to my computer account on my tmg....add the certificate to my web listener...it recognizes my certificate as a valid one, but when i test it, i show the message that my target principal name is incorrect....since i never issued a certificate like this, possibly, there's something wrong with the information i'm adding.... requesting the certificate using the .reg file would make everything easy.....maybe i don't know where to look, but i don't see anything related to this matter in event viewer.... Do you have any ideas why the certificates I'm trying do submit using MMC Certification Authority using the .req file are not been issued? Thanks for your help, and, I'm sorry for my english....It's not my first language, and I not really good at it...

  • Anonymous
    June 30, 2014
    I will confess to not being a security expert. So this article is not about how the process works, instead

  • Anonymous
    August 08, 2014
    Anonymous, would you mind sharing that batch file on pastebin?

    Thanks!

  • Anonymous
    November 03, 2014
    The link was very useful and we imported the certificate with private key on local server store. But we failed to export the certificate with private key from store to a file. Also we removed the certificate from store and tried to import it again using command certreq –accept and that also failed. Expect your comment on this

  • Anonymous
    March 13, 2015
    all information is really useful.

  • Anonymous
    October 08, 2015
    The comment has been removed

  • Anonymous
    November 03, 2015
    I know that validity period is handled in the CA Template so I wonder if using certutil or programatically (powershell, c#, etc..) I could update the validity attribute of an existing CA Template. Thanks,

  • Anonymous
    December 04, 2015
    The comment has been removed

  • Anonymous
    September 20, 2016
    If I want to send a cert request to a public CA, for a certificate that will be used by two different computers, can I use certreq then, with this .inf file?;----------------- request.inf ----------------- [Version] Signature="$Windows NT$" [NewRequest] Subject = "C=US, S=StateName, L=LocalityName, O=OrganizationName, CN=webserver.contoso.com" KeySpec = 1 KeyLength = 2048Exportable = TRUE MachineKeySet = TRUE SMIME = False PrivateKeyArchive = FALSE UserProtected = FALSE UseExistingKeySet = FALSE ProviderName = "Microsoft RSA SChannel Cryptographic Provider" ProviderType = 12RequestType = PKCS10 KeyUsage = 0xa0 [EnhancedKeyUsageExtension] OID=1.3.6.1.5.5.7.3.1 ; this is for Server AuthenticationOID=1.3.6.1.5.5.7.3.2 ; this is for Client Authentication ;-----------------------------------------------Or will the MachineKeySet = TRUE value mean that I can only use the cert on a single computer?

  • Anonymous
    October 07, 2016
    step 3 was helpful thank you kindly.Regards,RichLas Vegas

  • Anonymous
    February 02, 2017
    To automate life, is there options to add email address into certification? So that later when the certification is coming to be expired, we know whom to contact?