18. Create CSR and Install SSL certificate on IIS 10 from Internal CA

[@mvdefun]

Amazing video series! Filled all the knowledge gaps I was missing to get this done

[@MSFTWebCast]

Great to hear!

[@DaniLearnsIT]

You keep showing up in all the searches I do. Thank you so much for making these videos!

[@googleliker]

Just amazing and your videos has improved a lot I'm watching you since long time and now you have become my guide

[@MSFTWebCast]

Awesome, thank you!

[@anilmaz2024]

Very nicely done!! Thank you 🙏

[@JustJiril]

this was informative. thank you brother.

[@brittanysikora8727]

Thank you so much, just what I needed.

[@RupeshKumar-yv4qx]

Too good explanation. Very much helpful. Many Thanks

[@BaoTran-nm7un]

Thanks for great video, I have a small question. On the video, you showed the public key on this .cer file, how can we access the associated private key?

[@alphonsesossou4283]

Great tutorial. I have multiple domain controllers. How do I use a pfx certificate in such environment to get rid of "Not secure warning message" ?

[@davidbondo5591]

Awesome video ,please kindly do how to install certificate on the server after downloading

[@dodyjoko5514]

Very Fruitful, Terima Kasih Banyak

[@MSFTWebCast]

Thank You too.

[@ldavader2704]

Great video but I'm still having trouble... Everything seems ok from my CA machine's browser but from my client (Win10 pc) it shows as SSL_ERROR_BAD_CERT_DOMAIN. I've been looking under the Certificates Console and the CA certificate shows up under the Trusted Rooted Certification Autoritities. DNS resolution has also been check, not an issue. Still don't get it what happening... Suggestions? Thanks.

[@AdornedbyGod]

how did you get the website at 6:04?? I'm confused and stuck on that part

[@andreruiz3404]

(1)

[@mahmoudalaskalany]

this video deserves 1m like

[@GreekBistro]

another great and well explained video, thank you

[@bupathisuma7092]

Hello I have created a csr and got the signed cert to generate pfx file from the cer may I know the steps to follow

[@lhachimichaimae6405]

What is the difference between what you are doing in this video and the last three videos? It gives the same result, doesn't it?

[@nikolay.shpilchin]

Спасибо! Все очень понятно объясняете. Круто!

[@sivaprasad4263]

Followed your video steps working only on explorer other browser showing invalid certificate.please look into it

[@ismailhadjir9703]

Thanks for the video

[@TechTrendsBharat]

I want to install the SSL certificate on local IP like some web server (VMware-Esxi, vCenter console IP) can you share a separate video for its process

[@MSFTWebCast]

Why you want to install certificate with IP? You can use subject alternative name (SAN) option in certificate to add IPs.

[@eddykain4983]

Very well done Sir!

[@MSFTWebCast]

Thank you!

[@antoniorodrigues8495]

Hello i got this message while completing the certificate signing request " No certificate templates could be found. You do not have permission to request a certificate from this CA, or an error occurred while accessing the Active Directory. "

[@chunwaihome]

I follow your video, memeber web server can access only itself https without warning, but how make other domain clients can also access https without warning?

[@MSFTWebCast]

1. Distribute root CA certificate group policy or 2. Configure Group Policy to Auto-enroll and Deploy Certificates.

[@garugubilliprasad4563]

Can you please let me know how can i create csr for 3 yrs expiry and how can i mention 3 yrs validity in that certificate

[@venkateshm6040]

Which format SSL cert for Windows servers?

[@MSFTWebCast]

.cer format.

[@venkateshm6040]

@@MSFTWebCast But windows server will pick only pfx cert only, right? and as you said in the process that will not create a private key, How do we get private key?

[@MSFTWebCast]

@@venkateshm6040 Hello, could you please provide more details about what you're trying to accomplish?

[@ramamannem8729]

@@MSFTWebCast I want to place DIGICERT in Windows server, the cert need private key, how to generate a private key to import pfx cert?

[@eliassal1]

well explained video. Can you tell me how we can add attributes like Subject alternative name and issuer Alternative Name as this is necessary to force chrome trust the certificate and stops displaying the red "Not secure" text? Thanks for your efforts

[@MSFTWebCast]

You can follow this video to create certificate with Subject Alternative Names: kzbin.info/www/bejne/oaPHao2pf6iNbNU If you are using self-signed certificate than import the certificate into trusted root certification authorities certificate store. In case, you are using internal Certification authority then import CA certificate into trusted root certification authorities certificate store. This will fix the "Not Secure" error.

[@eliassal1]

@@MSFTWebCast with Chrome it is not sufficient import CA certificate into trusted root, certificate should have SAN DNS name

[@eliassal1]

I watched the other video, very useful and informative, however, after creating the SAN certificate, adding it to IIS, then on my dev win 10 machine, added the certificate to the trusted zone, nor chrome nor edge wants to accept it, still getting "Not secure" whereas certificates I have created in the past with XCA tool were accepted by chrome

[@MSFTWebCast]

@@eliassal1 Can you mail me the screenshot of certificate with names and the error as well. You can find my email address on about tab (Channel Page).

[@eliassal1]

@@MSFTWebCast Email sent with screenshots

[@cdphotography2]

If I wanted to add additional attributes for for SAN names or hostnames what is the format for that ? Is it just list the names separated by space or commas or something else ?

[@MSFTWebCast]

Please refer this video: kzbin.info/www/bejne/oaPHao2pf6iNbNU

[@peter_mitch1880]

Do we need to be connected to internet for this to work ?

[@MSFTWebCast]

No, it will perfectly fine with local network.

[@seanaustin3815]

Great English! I learned something new watching your video :)

[@pear7777]

Why didn't your comment get upvotes?????

[@brianwatson1043]

Understood everything until internet explorer where you add your server address. Tried many things but could not get it to go to the page as in the video.

[@MSFTWebCast]

I used Internet Explorer to access the web enrollment interface of the Internal (Local) certificate authority, by using /certsrv Note: To access certificate web enrollment page, you must have installed the CA web enrollment service on your server.

[@abhijeetsingh6193]

Unable to browse web server from member server. Please help

[@7adt]

can i generate CSR certificate on IIS to use for another webserver?

[@MSFTWebCast]

You can generate the CSR from any server you like.

[@chunwaihome]

Does web server join domain

[@MSFTWebCast]

In this video, the web server is joined to the Active Directory domain.

[@alejandromarin9661]

Great video, thank you!

[@paperiswhite2]

instant new subscriber

[@MSFTWebCast]

Awesome, thank you!

[@nsomba]

Hello when I add "certsrv" to URL it doesn't get me the authentication instead it give me an error 404 this as minute 6.01

[@MSFTWebCast]

Did you check for certsrv virtual directory in IIS manager? Does the physical directory under C:\Windows\System32\CertSrv\En-US exists? The simple solution is: Uninstall and reinstall the certification authority web enrollment role. Keep in mind only CA web enrollment service.

[@AdornedbyGod]

Were you ever able to figure this out?? It's not making sense

[@MYTC6009]

Well explained video.

[@danielruzicka3858]

I got the "Certificate Pending and that I have to wait for the administrator, even tho I am the administrator in my own lab. Anyone knows how can I confirm or allow it ?

[@MSFTWebCast]

Open Certification Authority on your CA. Expand Local CA name and click on Pending Requests. Select the requested certificate and approve it.

[@adrianortiz7433]

thank you

[@fadwa2413]

enable CC please

[@gabrielluizbh]

Why don't you release subtitles.

[@MSFTWebCast]

Hi, this is the old video, I have started to add hard-coded subtitles in all the newer videos. Will try to add the subtitle in older videos too.

[@gabrielluizbh]

@@MSFTWebCast Thank you very much.

[@anzarsainudeen8806]

super ,

[@krishnasameer704]

Almost ok. But some steps are missed. And clarity missed.

[@MSFTWebCast]

Can you tell me more about the missing steps, so I could include those while re-creating the video with windows 11.

[@משהכהן-ס4כ]

it does not work on chrome

[@MSFTWebCast]

Google Chrome requires SSL certificates to use Subject Alternative Name (SAN) instead of the popular Common Name (CN). So you have to use SAN certificate.

[@ahmedsaad-lk2og]

good

[@Imhemantnegi]

my certificate came in the form of p7b, how to convert to .cer ?

[@MSFTWebCast]

Why dont you export the certificate again with .cer format? Yes, there are ways to convert it using some SSL converter tool but I have never tried it.

[@Imhemantnegi]

@@MSFTWebCast each time my ad certificate server is giving in p7b form only and when I am completing the request using p7b on iis, it is not recognizing the key. Basically looking for pfx or cer. My organization has given me the url of ad certificate server, like you were generaing in the video. Your certificate is coming in .cer but mine is coming in p7b

[@AdornedbyGod]

Did you ever figure this out?

[@DmitryMalyshok]

Спасибо

[@mdmanik-xy7ui]

😘😘😘😘😘💜💙💙💚