Configuring IIS7 (Win2008) with CNG

This section describes how to configure Microsoft Internet Information Services 7 (IIS7) on Windows Server 2008 for use with CNG.

To configure IIS7 on Windows Server 2008 for use with CNG

1.Install and configure your HSM.

2.Install and configure KSP:

a.Register your cryptoki.dll file

b.Register your slot for Administrator/(Server name or Domain name) and again for System/NT Authority.

3.Create a policy file to generate a cert request. Normally, you can do this directly through the GUI, but the KSP is not yet recognized through the GUI. The policy file (call it policy.inf) should look like this:

[New Request]
       KeyUsageProperty = “NCRYPT_ALLOW_DECRYPT_FLAG”
       Providertype = 1
       RequesterName = OTT1-HANNIBAL\Administrator
       RequestType = PKCS10
       ProviderName = “SafeNet Key Storage Provider”
       Subject = “CN=OTT1-HANNIBAL,OU=Eng,O=SafeNet-Inc,
L=Ottawa,S=Ontario,C=CA”
       KeyContainer = “OTT1-HANNIBAL”
       MachineKeySet = true
       HashAlgorithm = sha1
       KeyAlgorithm = RSA
       KeyLength = 2048

4.Using the above file, create your cert request:

C:\>certreq -new policy.inf cert.req

5.Submit your cert request to a CA and obtain a signed cert, and the root cert of the CA. Move these certificates to your IIS server.

6.Install the root certificate:

a.Open the root cert file and select “Install Certificate.”

b.At the Welcome screen, click Next.

c.You’ll need to specify the Certificate Store to be used. Select the “Place all certificates in the following store” radio button, and click the “Browse…” button.

d.In the Select Certificate Store window that opens, put a check in the “Show physical stores” box, locate and expand Trusted Root Certification Authorities and select “Local Computer” then click OK.

7.Open Server Manager and select “Add Roles” to install Web Server (IIS). Configure to your needs, though the default options will do for the purposes of this document.

8.When the installation is complete, expand the Roles tree from the left-hand pane, then expand Web Server (IIS) and select “Internet Information Services (IIS) Manager,” then select the object name (most likely your server’s name) from the Connections pane, as shown below:

9.Under the Home pane, open Server Certificates, then select “Complete Certificate Request…” from the Actions pane.

10.Complete the form that opens; select the path to your certificate and choose a friendly name for said certificate and click OK:

11.The certificate list will then be populated by the certificate you specified:

12.Under the Connections pane, expand the server hostname tree (in the example below, OTT1-HANNIBAL), then expand the Sites tree, and select “Default Web Site”:

13.Select “Bindings” from the Actions pane on the right-hand side. This opens the Site Bindings box.

14.Click Add, and make the following selections:

Type	https
IP Address	Can be left as “All unassigned”
Port	Can be left as 443
SSL certificate	Select the friendly name you assigned earlier to your certificate when your completed the cert request.

Click OK to continue.

15.Under the actions pane, you will now have a link labeled “Browse *:443 (https)” (this may appear slightly different, depending on the IP Address options you set in the previous step).

16.Select this link and it will show you your default webpage over a secure connection. Configure your website as needed.