I need to issue a certificate for SSL binding in IIS using Active Directory Certificate Authority.

As far as I understand it should have Purpose=Auth Server and contain private key/be exportable.

But Template=Web Server at https://dc.domain.local/certsrv/certrqma.asp has checkbox 'Mark keys as exportable' unselected and disabled.

1 Answer 1


You have to duplicate the server authentication certificate template, and make the keys exportable, and enroll in your new cert template instead.

enter image description here

  • Use the "Certificate Templates" MMC snapin. Right click on, for instance, the Web Server certificate template and click "Duplicate Template." Give the new duplicate all the properties that you want it to have, such as permissions for who can enroll in it, key usages, mark private key exportable, etc.. Once done, use the "Certificate Authority" MMC snapin. Go to Certificate Templates, right click in an empty space and choose New -> Cert. Template to Issue. Choose your new template.
    – Ryan Ries
    Commented Dec 21, 2013 at 20:32
  • Also I'm skeptical that the key needs to be exportable in the first place - you just need to generate and complete the certificate request on the same machine. Unless you have a special need to transfer the private key to several different web servers.
    – Ryan Ries
    Commented Dec 21, 2013 at 20:33
  • (I deleted my comment/question because decided to google instead, looks too simple for asking) Commented Dec 21, 2013 at 21:44
  • IIS snap-in does't list certs having no private key, I don't know why. So default Web Server cert template doesn't work here, looks weird and not MS typical. Commented Dec 21, 2013 at 21:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .