2

I need to issue a certificate for SSL binding in IIS using Active Directory Certificate Authority.

As far as I understand it should have Purpose=Auth Server and contain private key/be exportable.

But Template=Web Server at https://dc.domain.local/certsrv/certrqma.asp has checkbox 'Mark keys as exportable' unselected and disabled.

2

You have to duplicate the server authentication certificate template, and make the keys exportable, and enroll in your new cert template instead.

enter image description here

  • Use the "Certificate Templates" MMC snapin. Right click on, for instance, the Web Server certificate template and click "Duplicate Template." Give the new duplicate all the properties that you want it to have, such as permissions for who can enroll in it, key usages, mark private key exportable, etc.. Once done, use the "Certificate Authority" MMC snapin. Go to Certificate Templates, right click in an empty space and choose New -> Cert. Template to Issue. Choose your new template. – Ryan Ries Dec 21 '13 at 20:32
  • Also I'm skeptical that the key needs to be exportable in the first place - you just need to generate and complete the certificate request on the same machine. Unless you have a special need to transfer the private key to several different web servers. – Ryan Ries Dec 21 '13 at 20:33
  • (I deleted my comment/question because decided to google instead, looks too simple for asking) – abatishchev Dec 21 '13 at 21:44
  • IIS snap-in does't list certs having no private key, I don't know why. So default Web Server cert template doesn't work here, looks weird and not MS typical. – abatishchev Dec 21 '13 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.