Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
JSI Tip 6395. Certificate Services in a Non-Active Directory Environment: Installation and Issuing Certificates.
Jerold Schulman
March 2, 2003
7 Min Read
NOTE: The text in the following Microsoft Knowledge Base article is provided so that the site search can find this page. Please click the Knowledge Base link to insure that you are reading the most current information.
Microsoft Knowledge Base article Q272555 contains:
IN THIS TASK
SUMMARY
Install the Certificate Server
Create an MMC Snap-in to Administer the Certificate Server
Create a Certificate Request for an IIS Web Site
Submit the Certificate Request Using Certificate Services
Approve the Certificate Request
Download and Install the Certificate
Request a Client Certificate
Approve the Client Certificate
Install the Certificate on the Client Computer
REFERENCES
SUMMARY
This step-by-step article describes how to install and configure a Certificate Server in a non-Active Directory environment. It includes step-by-step instructions for installing the server and client certificates.
back to the top
Install the Certificate Server
To install a Certificate Server on your Windows 2000 server:
Click Start, point toSettings and then click ControlPanel.
In Control Panel, double-click Add/RemovePrograms.
Click Add/Remove Windows Components tostart the Windows Component Wizard.
In the Windows Component Wizard, click to selecttheCertificate Services check box.
Click Yes to confirm that this computercan no longer be renamed and cannot change domain membership.
Click Next.
Click Remote administration mode, and thenclick Next.
Click Stand-alone root CA, and then clickNext.
Type the CA name for your organization, type any additionalinformation you may require, and then click Next.
Click Next.
Click OK to stop the Internet Informationservices.
Note You may be prompted for your Windows 2000 CD-ROM.When the Windows Components Wizard has completed, clickFinish.
back to the top
Create an MMC Snap-in to Administer the Certificate Server
To add the Microsoft Management Console (MMC) snap-in to administer Certificate Services:
Click Start, and then clickRun.
In the Open box, typeMMC, and then press ENTER.
On the Console menu, clickAdd/Remove Snap-in.
Click Add.
In the Add Standalone Snap-in dialog box,click Certification Authority, and then clickAdd.
Click Local computer, and then clickFinish.
Click Close.
Click OK.
Click Console, and then click SaveAs.
Type a name, and then clickSave.
back to the top
Create a Certificate Request for an IIS Web Site
To request a Web site certificate from the Certificate Services Server:
Start Internet Services Manager.
Double-click your IIS Server.
Right-click the Web site where you want to install thecertificate, and then click Properties.
Click Directory Security.
Click Server Certificate to start the WebServer Certificate Wizard.
Click Next.
Click Create a new certificate, and thenclick Next.
Click Next.
Type a name for the certificate, and then clickNext.
Type your organization name and organizational unit, andthen click Next.
In the Common name box, type a name foryour site by using your computer DNS or NetBIOS name, and then clickNext.
Complete the Geographical Informationpage, and then click Next.
Leave the default name for the certificate request, notethe name and location of this file, and then click Next.
Click Next.
Click Finish.
Click OK.
back to the top
Submit the Certificate Request Using Certificate Services
To submit the certificate request that you created in the previous procedure you must submit it to Certificate Services. Certificate Services then issues a certificate that you can install on your Web site. To do this:
Start Microsoft Internet Explorer, and then locate thefollowing URL
http://CertificateServerComputerName/certsrv
where CertificateServerComputerName isthe name of your Certificate Services server.
Click Request a Certificate, and thenclick Next.
Click Advanced Request, and then clickNext.
Click Submit a certificate request using a base64encoded PKCS #10 file or a renewal request using a base64 encoded PKCS #7file, and then click Next.
Put the contents of the certificate request file that youcreated in the previous procedure on the Submit A SavedRequests page. Only put the text that appears between the followingtwo lines:
-----BEGIN NEW CERTIFICATE REQUEST----------END NEW CERTIFICATE REQUEST-----
Note Do not include the BEGIN and END lines. Only use the text thatappears between them.Click Submit.
The Certificate Pending page appears andstates:
Your certificate request has been received.However, you must wait for an administrator to issue the certificate yourequested. Please return to this web site in a day or two to retrieve yourcertificate.
Note: You must return with this web browser within 10days to retrieve your certificate
Your certificate request has beensubmitted.
back to the top
Approve the Certificate Request
To approve the certificate request, you must manually approve the request by using the Certificate Services MMC that you previously created:
Start the Certificate Services console that you created inthe "Create an MMC Snap-in to Administer the Certificate Server" section ofthis article.
Double-click Certification Authority(local), and then double-click your server.
In the right pane, double-click PendingRequests.
In the right pane, right-click the request, point toAll Tasks, and then click Issue.
back to the top
Download and Install the Certificate
To install the approved certificate, you must first download it from Certificate Services and then install it on your computer:
Start Internet Explorer, and then locate the following URL
http://CertificateServerComputerName/certsrv
where CertificateServerComputerName isthe name of your Certificate Services server.
Click Check on pending certificate, andthen click Next.
Click the request you submitted, and then clickNext.
Click Download CA certificate.
In the File Download dialog box, clickSave this file to disk, and then clickOK.
Specify the location to save the file, and then clickSave.
Click Open.
In the Certificate dialog box, clickInstall Certificate to start the Certificate ImportWizard.
Click Next.
Click Automatically select the certificate storebased on the type of certificate, and then clickNext
Click Finish.
Click OK to confirm the import.
Click OK.
back to the top
Request a Client Certificate
To request a client certificate:
Start Internet Explorer, and then locate the following URL
http://CertificateServerComputerName/certsrv
where CertificateServerComputerName isthe name of your Certificate Services server.
Click Request a Certificate, and thenclick Next.
Click Web Browser Certificate, and thenclick Next.
Complete the Identifying Informationboxes, and then click Submit.
Note Required fields can be determined by the Certificate Servicesadministrator.The Certificate Pending page appears andstates:
Your certificate request has been received.However, you must wait for an administrator to issue the certificate yourequested. Please return to this web site in a day or two to retrieve yourcertificate.
Note: You must return with this web browser within 10days to retrieve your certificate
Your certificate request has beensubmitted.
back to the top
Approve the Client Certificate
To approve the client certificate request:
Start the Certificate Services console that you created inthe "Create an MMC Snap-in to Administer the Certificate Server" section ofthis article.
Double-click Certification Authority(local), and then double-click your server.
In the right pane, double-click PendingRequests.
In the right pane, right-click the request, pointto All Tasks, and then click Issue.
back to the top
Install the Certificate on the Client Computer
To install the client certificate:
Start Internet Explorer, and then locate the following URL
http://CertificateServerComputerName/certsrv
where CertificateServerComputerName isthe name of your Certificate Services server.
Click Check on pending certificate, andthen click Next.
Click the request that you submitted, and then clickNext.
Click Install this certificate.
The Certificate Installed page appears and states:
Your new certificate has been successfullyinstalled.
back to the top
REFERENCES
For additional information about related topics, click the following article numbers to view the articles in the Microsoft Knowledge Base:
228836 Installing a New Certificate with Certificate Wizard for Use in SSL/TLS
324069 HOW TO: Set Up an HTTPS Service in IIS
back to the top
About the Author
You May Also Like
.jpg?width=700&auto=webp&quality=80&disable=upscale)
