Windows PKI blog

News and information for public key infrastructure (PKI) and Active Directory Certificate Services (AD CS) professionals

How to create a web server SSL certificate manually

How to create a web server SSL certificate manually

  • Comments 17
  • Likes

The Internet Information Server (IIS) and Microsoft Internet Security and Acceleration (ISA) provide wizards in the administration user interface to request and install SSL certificates. With this blog post I want to explain how to request a SSL server certificate manually. The manual steps are required if the Certification Authority (CA) is not available in the same forest as the IIS or ISA is a member of.

1. Creating an INF file to set the certificate properties

Use Notepad to modify the following sample INF file according to your needs. Safe the file as ssl.inf for example

[Version]
Signature="$Windows NT$"

[NewRequest]
Subject = "CN=SERVER.CONTOSO.COM"   ; For a wildcard use "CN=*.CONTOSO.COM" for example
; For an empty subject use the following line instead or remove the Subject line entierely
; Subject =

Exportable = FALSE                  ; Private key is not exportable
KeyLength = 2048                    ; Common key sizes: 512, 1024, 2048, 4096, 8192, 16384
KeySpec = 1                         ; AT_KEYEXCHANGE
KeyUsage = 0xA0                     ; Digital Signature, Key Encipherment
MachineKeySet = True                ; The key belongs to the local computer account
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
SMIME = FALSE
RequestType = CMC

; At least certreq.exe shipping with Windows Vista/Server 2008 is required to interpret the [Strings] and [Extensions] sections below

[Strings]
szOID_SUBJECT_ALT_NAME2 = "2.5.29.17"
szOID_ENHANCED_KEY_USAGE = "2.5.29.37"
szOID_PKIX_KP_SERVER_AUTH = "1.3.6.1.5.5.7.3.1"
szOID_PKIX_KP_CLIENT_AUTH = "1.3.6.1.5.5.7.3.2"

[Extensions]
%szOID_SUBJECT_ALT_NAME2% = "{text}dns=computer1.contoso.com&dns=computer2.contoso.com"
%szOID_ENHANCED_KEY_USAGE% = "{text}%szOID_PKIX_KP_SERVER_AUTH%,%szOID_PKIX_KP_CLIENT_AUTH%"

[RequestAttributes]
CertificateTemplate= WebServer

Notes:

  • leave off the Subject= line if you want the subject to be empty
  • if you don’t need the template to be specified, remove the RequestAttributes section
  • the specification of the enhanced key usage OID is not explicitly required since the EKU is defined in the certificate template. The OID in the INF file above is for explanatory purposes
  • you can click on “OK” for the template not found UI from certreq if the client has no access to templates
  • you can ignore the unreferenced “[Strings]” section dialog when it appears

2. Compiling the INF file into a REQ file

The following command-line command will generate key material and turn the INF file into a certificate request.

certreq –new ssl.inf ssl.req

Once the certificate request was created you can verify the request with the following command:

certutil ssl.req

3. Submitting the REQ file to the CA

If the CA is reachable via RPC over the network, use the following command to submit the certificate request to the CA:

certreq –submit ssl.req

You will get a selection dialog to select the CA from. If the CA is configured to issue certificates based on the template settings, the CA may issue the certificate immediately.

If RPC traffic is not allowed between the computer where the certificate request was created and the CA, transfer the certificate request to the CA and perform the above command locally at the CA.

If the certificate template name was not specified in the certificate request above, you can specify it as part of the submission command:

certreq -attrib "CertificateTemplate:webserver" –submit ssl.req

4. Installing the certificate at the IIS or ISA computer

Once the certificate was issued and is available as a file on the target computer, use the following command to install it.

certreq –accept ssl.cer

The installation actually puts the certificate into the computer’s personal store, links it with the key material created in step #1 and builds the certificate property. The certificate property stores information such as the friendly name which is not part of a certificate.

After performing steps 1 to 4 the certificate will show up in the IIS or ISA management interface and can be bound to a web site or a SSL listener.

Comments
  • I am trying to use what you have here to automate the enrollment of certificates for IIS 7.0 under Windows 2008 Server from our AD Certificate Server.  When I use the WebServer template, I am denied permission to submit the certificate.

    When I use the template name 'Computer' (which matched the template name I see when I create a certificate via the MMC certificate console), I get a 'Template not found' error.  How do I get the template name that is used when I enroll via MMC?

  • The "permission denied" problem can be corrected by changing the template permissions with certtempl.msc

    The "Computer" template is not found if the machine is not connected to the forest where the CA is installed. In this case the error can be ignored unless the name of the template is provided in the certutil -submit command (as explained in step #3

  • Hi, I can't finish second step. Got an error on certreq –new ssl.inf ssl.req command:

    Active Directory Enrollment Policy

    {164AF455-2832-4C63-989C-069F3EA3B675}

     ldap:

    Certificate Request Processor: The string contains an invalid X500 name attribut

    e key, oid, value or delimiter. 0x80092023 (-2146885597)

    cert.inf([NewRequest] Subject = "MySub")

    Could you please list mandatory parameters and those I have to change for my server?

  • One more question. When I'm creating certificate using Windows Server 2008, could be possible that it is not compatible with windows XP?

  • Could you please share the INF file that you have used. You only have to change the Subject attribute from the above sample.

  • The [Strings] and [Extensions] sections are NOT understood by the certreq version shipping with Windows XP.

  • I'm having trouble requesting a new certificating using web enrollment page, with the error THAT NOT CERTIFICATE TEMPLATES COULD BE FOUND, and already followed all the solutions saying i should set the permissions on the certificates templates, and checking adsiedit config dnshostname with the file on windows\system32\certsrv and nothing worked....I tried requesting the certificate using command line, and I'm receiving the message Certificate not issued (Incomplete)... nothing else..... any ideias?

  • Rafael, what OS version is the CA running on?

  • I'm running Windows Server 2008 R2 fully updated.... Any ideias? I can request certificates from mmc console -> certificates >request a new certificate.... Recently I installed Lync Server, and had no problem requesting certificates....The problem is only with the web enrollment interface....

    I don't know where to look anymore... I'm almost installing a now CA on my environment just to request this certificate.... Any ideias??? Tks for your help...

  • From Windows Server 2008 and on you cannot request computer certificates through the web enrollment pages anymore. See also technet.microsoft.com/.../cc732517(WS.10).aspx and search for "computer certificate"

  • I know it's a different topic, but the issue is related....Let me explain what I'm trying to do.

    I'm trying to create a certificate for exchange server 2010 outlook anywhere.

    I create de .req file on EMC and try to submit it using the certification authority on administrative tools, submit new request, i select the .req file created using exchange emc, but nothing happens. Nothing appears on "Pending requests"  or "failed requests"....

    When I go to MMC, Certificates, Computer certificates, and request a certificate from there, It works, I add a service for the certificate, in this case, iis since i'm trying to get outlook anywhere to work, and the certificate to my computer account on my tmg....add the certificate to my web listener...it recognizes my certificate as a valid one, but when i test it, i show the message that my target principal name is incorrect....since i never issued a certificate like this, possibly, there's something wrong with the information i'm adding.... requesting the certificate using the .reg file would make everything easy.....maybe i don't know where to look, but i don't see anything related to this matter in event viewer....

    Do you have any ideas why the certificates I'm trying do submit using MMC Certification Authority using the .req file are not been issued?

    Thanks for your help, and, I'm sorry for my english....It's not my first language, and I not really good at it...

  • To issue a certificate to your TMG box, see technet.microsoft.com/.../cc302625.aspx.

    Withouth seeing the actual certificate request, it's impossible to say why the CA is ignoring it. What does the eventlog say?

  • Awesome

  • This worked for me, except that I needed to add a SAN name equal to the subject name to avoid an error where the browser warns that the name of the site does not match the certificate when browsing server.contoso.com using https. With Subject = "CN=SERVER.CONTOSO.COM" Use %szOID_SUBJECT_ALT_NAME2% = "{text}dns=server.contoso.com,dns=computer1.contoso.com&dns=computer2.contoso.com"

  • This work brilliantly, thanks for taking the time to publish. I managed to create a batch file to automate the whole process via Task Scheduler every 2 years, works a treat. I would like to know how to add a friendly name to the certificate within the ssl.inf file if possible.

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment