How to issue a cert for web hosting using ad cert authority

Question

I need to issue a certificate for SSL binding in IIS using Active Directory Certificate Authority.

As far as I understand it should have Purpose=Auth Server and contain private key/be exportable.

But Template=Web Server at https://dc.domain.local/certsrv/certrqma.asp has checkbox 'Mark keys as exportable' unselected and disabled.

Ryan Ries · Accepted Answer · 2013-12-21 20:23:50Z

2

You have to duplicate the server authentication certificate template, and make the keys exportable, and enroll in your new cert template instead.

enter image description here

answered Dec 21, 2013 at 20:23

Ryan Ries

55.5k10 gold badges142 silver badges199 bronze badges

Use the "Certificate Templates" MMC snapin. Right click on, for instance, the Web Server certificate template and click "Duplicate Template." Give the new duplicate all the properties that you want it to have, such as permissions for who can enroll in it, key usages, mark private key exportable, etc.. Once done, use the "Certificate Authority" MMC snapin. Go to Certificate Templates, right click in an empty space and choose New -> Cert. Template to Issue. Choose your new template.
– Ryan Ries
Dec 21, 2013 at 20:32
Also I'm skeptical that the key needs to be exportable in the first place - you just need to generate and complete the certificate request on the same machine. Unless you have a special need to transfer the private key to several different web servers.
– Ryan Ries
Dec 21, 2013 at 20:33
(I deleted my comment/question because decided to google instead, looks too simple for asking)
– abatishchev
Dec 21, 2013 at 21:44
IIS snap-in does't list certs having no private key, I don't know why. So default Web Server cert template doesn't work here, looks weird and not MS typical.
– abatishchev
Dec 21, 2013 at 21:45

Add a comment |

1 Answer 1