Configuring IIS7 (Win2008) with CNG

This section describes how to configure Microsoft Internet Information Services 7 (IIS7) on Windows Server 2008 for use with CNG.

To configure IIS7 on Windows Server 2008 for use with CNG

1. Install and configure your HSM.

2. Install and configure KSP:

   1. Register your cryptoki.dll file

      

   2. Register your slot for Administrator/(Server name or Domain name) and again for System/NT Authority.

      

3. Create a policy file to generate a cert request. Normally, you can do this directly through the GUI, but the KSP is not yet recognized through the GUI. The policy file (call it policy.inf) should look like this:

   [NewRequest]
          KeyUsageProperty = "NCRYPT_ALLOW_DECRYPT_FLAG"
          Providertype = 1
          RequesterName = OTT1-HANNIBAL\Administrator
          RequestType = PKCS10
          ProviderName = "SafeNet Key Storage Provider"
          Subject = "CN=OTT1-HANNIBAL,O=CompanyName"
          KeyContainer = "OTT1-HANNIBAL"
          MachineKeySet = true
          HashAlgorithm = sha256
          KeyAlgorithm = RSA
          KeyLength = 2048
   

4. Using the above file, create your cert request:

   C:\>certreq -new policy.inf cert.req
   

5. Submit your cert request to a CA and obtain a signed cert, and the root cert of the CA. Move these certificates to your IIS server.

6. Install the root certificate:

   1. Open the root cert file and select “Install Certificate.”

   2. At the Welcome screen, select Next.

   3. You’ll need to specify the Certificate Store to be used. Select the “Place all certificates in the following store” radio button, and select the “Browse…” button.

   4. In the Select Certificate Store window that opens, put a check in the “Show physical stores” box, locate and expand Trusted Root Certification Authorities and select “Local Computer” then select OK.

      

7. Open Server Manager and select “Add Roles” to install Web Server (IIS). Configure to your needs, though the default options will do for the purposes of this document.

8. When the installation is complete, expand the Roles tree from the left-hand pane, then expand Web Server (IIS) and select “Internet Information Services (IIS) Manager,” then select the object name (most likely your server’s name) from the Connections pane, as shown below:

   

9. Under the Home pane, open Server Certificates, then select “Complete Certificate Request…” from the Actions pane.

10. Complete the form that opens; select the path to your certificate and choose a friendly name for said certificate and select OK:

    

11. The certificate list will then be populated by the certificate you specified:

    

12. Under the Connections pane, expand the server host name tree (in the example below, OTT1-HANNIBAL), then expand the Sites tree, and select “Default Web Site”:

    

13. Select “Bindings” from the Actions pane on the right-hand side. This opens the Site Bindings box.

    

14. Select Add, and make the following selections:

    Type — https
    IP Address — Can be left as “All unassigned”
    Port — Can be left as 443
    SSL certificate — Select the friendly name you assigned earlier to your certificate when your completed the cert request.

    

    Select OK to continue.

15. Under the actions pane, you will now have a link labeled “Browse *:443 (https)” (this may appear slightly different, depending on the IP Address options you set in the previous step).

    

16. Select this link and it will show you your default webpage over a secure connection. Configure your website as needed.