How to Configure Certificate Server for Use with SSL on IIS

ID: Q218445

The information in this article applies to:
  • Microsoft Internet Information Server version 4.0

SUMMARY

You can use Certificate Server to issue certificates for use with the Secure Sockets Layer (SSL). This is typically done on a local intranet, where you have the ability to directly inform your clients that they can trust your certificates.


MORE INFORMATION

IIS supports the SSL 3.0 protocol, which uses certificates to identify both the client and server during communication, and to establish a one-time session key to encrypt and decrypt data transmitted during that particular communication session.

You can use Certificate Server 1.0, which is a component of the Windows NT Option Pack, to issue certificates for your clients to use.

Before SSL can be used, the following tasks must be performed on the server:

  1. Create a Root CA Certificate on the server.


  2. Install the Root CA Certificate on the server.


  3. Create a Key Certificate Request for the server.


  4. Process the Key Certificate Request for the server.


  5. Install the Key Certificate on the server.


  6. Secure the directory on the server.


Next, perform the following tasks on the client:
  1. Install the Root CA Certificate on the client.


  2. Install a Certificate on the client.


  3. Connect to the SSL-Secured directory from the client.


NOTE: Each of the tasks listed above correspond to a section below. Go to that section for details on how to perform that particular task.

Creating a Root CA Certificate on the Server

To create a root CA certificate on the server, simply perform the default installation of the Certificate Server component of the Windows NT Option Pack. The default installation automatically creates a root CA certificate.

NOTE: If you choose to use Advanced Configuration, do NOT select the Non-root CA option.

Installing the Root CA Certificate on the Server

  1. Browse to http://localhost/certsrv/, click the Certificate Enrollment Tools link, and then click the Install Certificate Authority Certificates link.


  2. Click the Refresh button to verify that the information displayed is current, and then click the Certificate for ComputerName\CA-Name link.


  3. In the File Download dialog box, select the Open this file from its current location radio button, and then click OK.

    Perform the following steps if Windows NT 4.0, SP4 or SP5 is installed

    1. In the Certificate dialog box, click the Install Certificate button.


    2. When the Certificate Manager Import Wizard starts, click Next.


    3. When prompted to select a certificate store, select the Place all certificates into the following store radio button, and then click Browse.


    4. Select the Show Physical Stores option, open Trusted Root Certificate Authorities, and then click Local Computer. Click OK.


    5. Click Next, and then click Finish. Click OK to close the dialog box.


    6. Restart the server to cause the root CA certificate to take effect.


    For additional information, please see the following article(s) in the Microsoft Knowledge Base:
    Q194788 Windows NT Service Pack 4 and Client Certificates

    Perform the following steps if Windows NT 4.0, SP3 is installed

    1. In the New Site Certificate dialog box, click OK (you will typically want to leave all of the check boxes selected).


    2. When prompted by Do you want to ADD the following certificate to the Root Store?, click Yes.


    3. At a command prompt, use the CD command to change directories to the %SystemRoot%\System32\InetSrv directory (for example, type cd \winnt\system32\inetsrv if your system root is \winnt).


    4. Type iisca, to synchronize the root CA certificate stores used by IIS and Internet Explorer.


    5. Force the registry to be re-read, so that the new root CA certificate is recognized. This is done by either restarting the server, or stopping the IISADMIN service and its dependent services (for example WWW, FTP, NNTP, SMTP, and so on) and then restarting the dependent services that you use. These services can be stopped and restarted by doing either of the following:

      • Open Control Panel, open Services, and then stop and restart the services.


        • -OR-

      • Run NET STOP and NET START commands at a command prompt. To do this, perform the following:

        1. At a command prompt, type net stop iisadmin /y to stop the IISADMIN service and its dependent services.


        2. Restart the dependent services you use. For example, to restart the WWW service, type net start w3svc. To restart FTP, type net start msftpsvc.








Creating a Key Certificate Request for the Server

  1. Start the Internet Service Manager (ISM), which loads the Internet Information Server snap-in for the Microsoft Management Console (MMC).


  2. Right-click the Web site, directory, or file to be secured, and then click Properties. Click the Directory Security (or File Security) tab.


  3. Under Secure Communications, click the Key Manager button.

    NOTE: This button will labeled "Edit" instead of "Key Manager" if a certificate has already been installed.


  4. In Key Manager, right-click WWW, and then click Create New Key.


  5. Click the Put the request in a file that you will send to an authority radio button, and then save the file to your hard disk. Be sure to remember the name and location of the file.

    NOTE: C:\NewKeyRq.txt is the default path and name for this file.


  6. Step through the rest of the Create New Key dialog boxes.

    NOTE: When prompted for your state, be sure to spell it out completely (do not use the abbreviation), with proper capitalization, so that the certificate request will be PKCS #10 compatible.


  7. Close the Key Manager, being sure to click Yes when prompted to Commit all changes now?


  8. In the MMC, click OK.


Processing the Key Certificate Request for the Server

  1. Open the text file created for the server request (C:\NewKeyRq.txt by default).


  2. Select and copy the text for the key, beginning with the line:
    -----BEGIN NEW CERTIFICATE REQUEST-----
    and ending with:
    -----END NEW CERTIFICATE REQUEST-----
    (in other words, include both of these lines).


  3. Browse to http://localhost/certsrv/, click the Certificate Enrollment Tools link, and then click the Process a Certificate Request link.


  4. On the Web Server Enrollment page, paste the text from the key into the text box, and then click Submit Request.


  5. When the certificate has been successfully processed, click the Download button.


  6. Click the Save this file to disk radio button, and then save the file. Be sure to remember the name and location of the file.

    NOTE: Newcert.cer is the default name for this file.


Installing the Key Certificate on the Server

  1. In the MMC, right-click the Web site, directory, or file to be secured, and then click Properties. Click the Directory Security (or File Security) tab.


  2. Under Secure Communications, click the Edit button (note that this changed from previously being labeled Key Manager). Now click the Key Manager button.


  3. In Key Manager, right-click the new key request (the icon with a red slash through it), and then click Install Key Certificate.


  4. Select the certificate file, and then when prompted, provide the password. Click OK.


  5. In the Server Bindings dialog box, Any Unassigned should be displayed under both the IP Address and Port Number columns. Click OK (unless you want to assign the key to particular IP address and port number).


  6. Close Key Manager and make sure to click Yes when prompted to Commit all changes now?


  7. Click OK twice to return to the MMC.


Securing the Directory on the Server

  1. In the MMC, right-click the the Web site, directory, or file to be secured, and then click Properties.


  2. Click the Directory Security (or File Security) tab. Under Secure Communications, click the Edit button.


  3. Select the Require Secure Channel when accessing this resource check box.


  4. Select the Require Client Certificates radio button.


  5. Click OK twice to return to the MMC.


Installing the Root CA Certificate on the Client

  1. Browse to http://ServerDomainName/certsrv/, click the Certificate Enrollment Tools link, and then click the Install Certificate Authority Certificates link.


  2. Click the Refresh button to verify that the information displayed is current, and then click the Certificate for ServerDomainName\CA-Name link.


  3. In the File Download dialog box, select the Open this file from its current location radio button, and then click OK.


  4. The dialog box displayed next will depend on which Service Pack has been applied to Windows NT 4.0.


If SP4 or SP5 Is Installed

  1. In the Certificate dialog box, click the Install Certificate button.


  2. When the Certificate Manager Import Wizard starts, click Next.


  3. When prompted to select a certificate store, select the Place all certificates into the following store radio button, and then click Browse.


  4. Select the Show Physical Stores checkbox, open Trusted Root Certificate Authorities, and then select Local Computer. Click OK.


  5. Click Next, and then click Finish. Click OK to close the dialog box.


  6. Restart the computer.


If SP3 Is Installed

  1. In the New Site Certificate dialog box, click OK (you will typically want to leave all of the check boxes selected).


  2. When prompted by Do you want to ADD the following certificate to the Root Store?, click Yes.


  3. Restart the client computer, so that the new root CA certificate will take effect.


Installing a Certificate on the Client

  1. Browse to http://ServerDomainName/certsrv/, click the Certificate Enrollment Tools link, and then click the Request a Client Authentication Certificate link.

    NOTE: In Internet Explorer, security must be set to Medium in order to download the ActiveX control on this Web page. (Netscape does not use the ActiveX control, so the security setting is not an issue for it).


  2. Fill in the information requested in Certificate Enrollment Form the page, and then click the Submit Request button.


  3. When the certificate has been successfully processed, click the Download button.


  4. Click OK when you see the message Your new certificate has been successfully installed!


Connecting to the SSL-Secured Directory from the Client

  1. Browse to https://ServerDomainName/SecuredResource

    NOTE: Be sure to use the httpS protocol, not just http, so that the server will create a secure connection.


  2. When the Client Authentication dialog box appears, select the certificate you just installed (in the section above), and then click OK.


You should now have a secure connection from the client to the server, using SSL.

Additional query words: ntop certsrv certsvr

Keywords :
Version : winnt:4.0
Platform : winnt
Issue type : kbhowto


Last Reviewed: May 26, 1999
© 2000 Microsoft Corporation. All rights reserved. Terms of Use.