In previous post, I demonstrated steps to install a Certificate Authority server as well as enabling Web enrollment. All good so far. However, when we tried to proceed with web enrollment, below message box appeared :
To make it worst (not really), if we tried to access to the web page by using HTTPS, no page can be displayed.
Luckily, Microsoft has compiled all needed steps on how to get it resolved, as posted here.
In order to complete certificate enrollment, the Web site for the CA must be configured to use HTTPS authentication. |
To make it worst (not really), if we tried to access to the web page by using HTTPS, no page can be displayed.
Luckily, Microsoft has compiled all needed steps on how to get it resolved, as posted here.
Implementing SSL on a Web site in the domain with an Enterprise CA
The following example will assume that you have an Enterprise CA from which to issue certificates. Further, the assumption is that you have a Certification Authority Web Enrollment pages installed, either on that CA or on another computer in the domain. This example will walk through the steps necessary to do the following:
- Configure an appropriate certificate template for SSL certificates.
- Obtain a certificate for IIS using the certificate template
- Configure the HTTPS on the Default Web Site
- Connect to the HTTPS location for certificate enrollment
So, let's start with those steps.
1) Configure an appropriate certificate template for SSL certificates.
- Launch Certificate Authority Console
- Right click Certificate Templates | Manage
- Certificate Templates Console will launch. Look for Web Server template, right click at it, and choose Duplicate Template
- At Compatibility tab, you may want to maintain or change the settings depending on the environment.
- Go to General tab, and change the name of the template to reflect correct usage. Change the certificate validity and renewal period if needed.
- Go to Security tab, add 2 information :
- User/Group Accounts which will be used in enrollment
- Computer accounts which require ability to enroll
- Go to Cryptography tab, make changes if needed. Once all good, click Apply then OK.
- New template created. Close the Certificate Templates Console.
- At Certificate Authority Console, right click at Certificate Templates | New | Certificate Template to Issue. Find the newly created certificate templates, click on it, then click OK.
2) Obtain a certificate for IIS using the certificate template
- Launch MMC console
- Go to File | Add/Remove Snap-in...
- Click at Certificate | Add >
- Choose Computer account, and click Next >
- Choose Local computer, then click Finish.
- Click OK.
- Expand certificate (Local Computer) | right click at Personal | Choose All Tasks | click at Request New Certificate
- click Next.
- Select Active Directory Enrollment Policy, then click next
- Click at ' More information is required to enroll for this certificate. Click here to configure settings. ' (coloured in blue).
- We need to configure who will receive the certificate. In this case, the rootCA server. At Subject tab, at Subject name box, change the type to Common name, put in the value, and click Add >. Once done, click Apply then OK.
- Click enroll.
- Enrolling
- Click Finish.
3) Configure the HTTPS on the Default Web Site
- Launch IIS Manager
- Navigate to Default Web Site (or if you have more, choose appropriately).
- At Action column, click at Bindings...
- Click at https, and click at Edit...
- Change the SSL certificate to correct certificate (you can press View... to check to whom certificate is being issued)
- Click OK.
- Click Close.
4) Connect to the HTTPS location for certificate enrollment
Comments
Post a Comment