Certificate Authority – Requesting, Downloading, Installing, and Binding Certificates

Certificate Authority is a server role introduced by Microsoft, to issue digital certificates to target recipients. These digital certificates enable the environment to communicate securely between each other.

This post illustrates on how to :-

1. Request certificate from an internal root CA
2. Download the certificate from internal root CA
3. Install the certificate to server
4. Bind the certificate to HTTPS protocol

However, this post won't explain on how to install internal CA server. you may refer here for that. So let's get started.

Request Certificate From an Internal Root CA

1.  Launch IIS Manager
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
2. Click at the server name. Inside the working space area, locate Server Certificate feature, and double click at it / right click | open feature
   
   
   
   
   
   
   
3. Click at Create Certificate Request...
   
   
   
   
   
   
   
4. Put in all needed info, and click Next
   
   
   
   
   
   
   
5. Select crypto service provider and bit length, click Next
   
   
   
   
   
   
   
6. Specify the location of the certificate request file. In can be in TXT file. Click Finish.
   
   
   
   
   
   
   
7.  CR file can be found at the location stated earlier.
   

Download the Certificate From Internal Root CA

1.  Access to CA web enrollment address
   
   
   
   
   
   
   
   
   
2.  Click at Request a certificate
   
   
   
   
   
   
   
   
   
3.  Click at advanced certificate request.
   
   
   
   
   
   
   
   
4.  Click at Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.
   
   
   
   
   
   
   
   
   
5.  Open previously created CR file, copy the content...
   
   
   
   
   
   
   
6.  Paste it inside the Saved Request. Change the Certificate Template to SSL template, and click Submit
   
   
   
   
   
   
   
   
7.  Click Yes.
   
   
   
   
   
   
   
8.  Click at Download certificate
   
   
   
   
   
   
   
   
9.  Certificate downloaded.
   
   
   

Install the Certificate To Server

1.  Launch IIS Manager, click at the server name, and open Server Certificates feature
   
   
   
   
   
   
   
2.  At Action column, click at Complete Certificate Request
   
   
   
   
   
   
   
   
3. Locate the cert (*.cer) previously downloaded, provide friendly name (usually I put the server name), and ensure the store is set to Personal. Click OK.
   
   
   
   
   
   
   
4.  Installing...
   
   
   
   
   
   
   
5.  Certificate Installed.
   
   
   

Bind the certificate to HTTPS protocol

1.  Launch IIS Manager, navigate to <serverName> | Sites | Default Web Site (or any different name if applicable).
   
   
   
   
   
   
   
   
   
   
   
2.  At Action column, click at Bindings...
   
   
   
   
   
   
   
   
   
   
   
3. Click at https, and click at Edit...
   
   
   
   
   
   
   
   
   
   
   
4.  Change the SSL certificate to previously installed certificate, then click OK.
   
   
   
   
   
   
   
   
   
   
   
5.  Click Close.
   
   
   
   
   
   
   
   
   
   
   
6.  The server is now good to use HTTPS protocol.

Read More

Installing an Internal CA on Server 2012

Certificate Authority is a server role introduced by Microsoft, to issue digital certificates to target recipients. These digital certificates enable the environment to communicate securely between each other. 

Installing an internal CA server is not too hard and pretty much straight forward I believe. 

Description :

Installing an Internal CA on Server 2012.

How To Do :

1.  Launch Server Manager, Go to Manage | Add Roles and Features
   
   
   
   
   
   
   
   
   
   
   
   
   
2.  Click Next >
   
   
   
   
   
   
   
   
   
   
   
3.  Ensure Role-based or feature-based installation is chosen, and click Next >
   
   
   
   
   
   
   
   
   
     
4.  Ensure the target server is selected from the server pool, and click Next >
   
   
   
   
   
   
   
   
   
   
   
5.  Check / tick Active Directory Certificate Services role
   
   
   
   
   
   
   
   
   
   
   
6.  The Add Roles and Features Wizard appeared. Click at Add Features button.
   
   
   
   
   
   
   
   
   
   
   
7.  Click Next > 
   
   
   
   
   
   
   
   
   
   
   
8.  Select additional features if needed, then click Next >
   
   
   
   
   
   
   
   
   
   
   
9.  Click Next >
   
   
   
   
   
   
   
   
   
   
   
10.  Check / tick Certificate Authority role service
    
    
    
    
    
    
    
    
    
    
    
11.  To enable web enrollment, Certificate Authority Web Enrollment role service needs to be enabled as well. Check / tick at it, then click Next > 
    
    
    
    
    
    
    
    
    
    
    
12. Once all confirmed, click Install
    
    
    
    
    
    
    
    
    
    
    
13. Installing...
    
    
    
    
    
    
    
    
    
    
    
14.  At Server Manager, hover to Notification, and click at at Post-Deployment Configuration to configure Certificate Services role.
    
    
    
    
    
    
    
    
    
    
    
15.  Click Change... if you want to change the credential used, then click Next >
    
    
    
    
    
    
    
    
    
    
    
16. Select which role services need to be configured, in this case the first two.
    
    
    
    
    
    
    
    
    
    
    
17.  Specify type of CA to be configured, either Enterprise CA or Standalone CA. Click Next > once done.You may refer to below links for better understanding :
    
    
    
    
    Enterprise CA : https://technet.microsoft.com/en-us/library/cc771443(v=ws.11).aspx
    
    
    Stand-Alone CA : https://technet.microsoft.com/en-us/library/cc755290(v=ws.11).aspx
    
    
    
    
    
    
    
    
    
    
    
18.  Specify whether the server should be a Root CA or Subordinate CA. In this case, Root CA is chosen as this is the  first CA in the environment. Click Next > 
    
    
    
    
    
    
    
    
    
    
    
19.  Specify whether to create a new private key or to use existing private key. You may refer to below link for better understanding on Private Key. Click Next > once done.
    
    
    Link : http://go.microsoft.com/fwlink/?LinkId=218060
    
    
    
    
    
    
    
    
    
    
    
20.  Choose Cryptographic provider, key length, and hash algorithm. Refer to below link for more info on cryptography. Click Next > 
    
    
    Link : http://go.microsoft.com/fwlink/?LinkId=218061
    
    
    
    
    
    
    
    
    
    
    
21.  Specify the name of the CA, then click Next >
    
    
    
    
    
    
    
    
    
    
    
22.  Specify the validity period of the Certificate, then click Next > 
    
    
    
    
    
    
    
    
    
    
    
23.  Specify the database locations, then click Next >
    
    
    
    
    
    
    
    
    
    
    
24.  Review the information populated, then click Configure.
    
    
    
    
    
    
    
    
    
    
    
25.  Configuring...
    
    
    
    
    
    
    
    
    
    
    
26. Done, click Close.
    
    
    
    
    
    
    
    
    
    
    
27.  CA Configured.
    
    

Read More

Unable to Update VMware Tools for vSphere 5.5 Update 3.

This one should be easy if you have a good troubleshooting skill. When I wanted to upgrade VMware Tools from previous version to the latest version, the installation hung at " Installing VMXnet3 driver ".

I used a few methods to get it upgraded :

1) simply upgrade VMware Tools from vCentre - hung

2) downloaded VMware Tools from here

 ( https://packages.vmware.com/tools/esx/index.html ) and get it installed - hung

3) Uninstalled current VMware Tools, rebooted the machine - blue screen

4) Uninstalled current VMware Tools, without rebooting the machine, performed upgrade from vCentre - hung

5) Uninstalled current VMware Tools, without rebooting the machine, performed manual upgrade usign EXE file- hung

So this made me thinking, the issue might not due to the installer ( as I tried from vCentre level as well as manual installation), but due to VM itself, as it hung at exact status (Installing VMXnet3 driver).

When I checked the VM, yes, it was using VMXNET3 driver for the vNIC. It was not too hard to narrow down, huh?

The journey started. I added another vNIC, but in this case I used E1000 type rather than VMXNET3.

Once done, I removed current vNIC.

As I used PVS, I needed to update MAC address for the target device (cool, huh?)

And without too much hassle, I managed to upgrade VMware Tools!

I did not restart the VM, but I turned it off completely.

Next, I added back vNIC with VMXNET3 type.

Update MAC address in PVS console, and get the VM started.

Tam tada dam! VMware Tools is now current!

Read More