Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo

All

  • All
back

Integration with IIS

Creating a certificate

search

Creating a certificate

This section describes various methods of creating a certificate that specifies the details of the ProtectToolkit-M machine so ProtectToolkit-M and the ProtectServer 3 HSM to be used for SSL processing.

Using IIS

When using IIS to install a certificate on the host machine, the following has to be performed:

  • Creating a certificate request

  • Sending the certificate request to be signed by a CA

  • Installing the signed certificate into IIS

To create a certificate request using IIS

  1. Start the Internet Services Manager from the Administrative Tools menu.

  2. Highlight the Default Web Site entry, and right-click to open a context menu. Select Properties. The default web site properties dialog opens. Select the Directory Security tab.

  3. Select the Server Certificate button. This will start the IIS Certificate Wizard.

  4. Choose Create a new certificate from the available options and press Next to continue.

  5. Choose Prepare the request now, but send it later from the available options and press Next to continue.

  6. Select SafeNet as the security provider. On the Name and Security Settings page that now displays, check the Select cryptographic service provider (CSP) for this certificate checkbox. Select Next to continue.

  7. Continue to follow the on-screen prompts until the certificate request is completed.

    The IIS Certificate Wizard creates the certificate request as a file. You should now forward this file onto your CA in order to have it signed. The CA returns a new file, which is the signed certificate.

Refer to Installing a certificate for use with IIS for details on how to install the signed certificate.

Creating a certificate using the Microsoft CA server

The Microsoft CA server provides a standard internet browser interface for the creation of certificates.

Note

Before starting the following procedure, ensure that the current logged on user has Windows administrator privileges and has a valid keyset.

To create a certificate using MS CA server

  1. Start the MS CA services interface by opening your web browser and specifying the Microsoft CA server URL. For example:

    http://hostname/certsrv

    The opening dialog for CA services appears.

  2. Select the Request a certificate option and press Next to continue. You are prompted to select the request type.

  3. Choose, Advanced request and press Next to continue. You will be presented with the Advanced Certificate Requests screen.

  4. Select Submit a certificate request to this CA using a form, and press Next to continue. You will be presented with a form to input the certificate details.

  5. Enter the details for the certificate into the fields provided:

    1. Certificate Name: enter the host machine's name. This can be found by executing the standard Windows command hostname from a command prompt.

    2. Intended Purpose: choose Server Authentication Certificate.

    3. Key Options: choose SafeNet RSA SChannel Cryptographic Provider as the CSP

    4. Key Usage: choose Exchange

    5. Key Size: enter as required, eg. “1024”

    6. select Create new key set

    7. if you want to be able to back up the keys associated with the certificate at a later date, choose Mark keys as exportable

    8. choose Use local machine store

    9. Additional Options: choose Hash Algorithm, for example, “MD5”

      Note

      If the current logged-on user’s keyset does not exist when the Safenet CSP is selected, the Hash Algorithm list box at the bottom of the screen will be empty. Should this be the case, abort this operation and create a keyset for the currently logged-on user before attempting this task again.

  6. Press the Submit button when you have confirmed your inputs. If the Microsoft CA was configured to “Auto Issue” certificates, you are presented with the Certificate Issued dialog.

    Select Install this certificate to complete the certificate request and installation.

    If CA Services is not configured to auto-issue certificates, the dialog will state that your certificate request is pending. You will have to check on the status of the certificate using the CA services at a later time. When the certificate is ready, you are presented with the Certificate Issued dialog.

Using the createcert utility

The createcert utility is provided as a simple means to create a self-signed certificate for the ProtectToolkit-M host machine.

Note

These certificates are intended for development and testing purposes only. Also ensure that the current logged on user has Windows administrator privileges and has a valid keyset.

You will need to know the machine name for the ProtectToolkit-M system. Run the standard Windows command hostname from a command prompt.

To create a self-signed certificate using createcert utility

From a command prompt, execute the utility createcert, specifying the machine name. For example, if the machine name is “betaone”, the command would be as follows:

C:\>createcert CN=betaone

Successful execution of the above will result in an RSA key pair being created, as well as a certificate which is saved in the file “selfsigned.cer”. This certificate is then automatically installed ready for IIS use.

File calles SelfSigned.cer has been saved.
Certificate created successfully and installed

On this page