Step 2: Creating Public and Private Certificates
In this step, you use the Certification Authority created in Step 1: Creating a Certification Authority [RN3] to generate the public and private certificates that the Contoso and Fabrikam organizations use.
To generate the Contoso and Fabrikam encryption certificates
On the computer you used as the Certification Authority, in Internet Explorer, locate and open http://<contoso_computername>/certsrv.
On the Welcome page, click Request a certificate.
On the Request a Certificate page, click advanced certificate request.
On the Advanced Certificate Request page, click Create and submit a request to this CA.
On the Advanced Certificate Request page, do the following:
Use this To do this Name Type Fabrikam Encryption. E-Mail Type jdoe@fabrikam.com. Company Type Fabrikam. Department Type Test. City Type Test. State Type Test. Country/Region Type US. Type of Certificate Needed Select E-Mail Protection Certificate from the drop down list. Key Usage Select the Exchange option. Additional Key Options Place a check in the following options:
- Mark keys as exportable
- Store certificate in the local computer certificate storeFriendly Name Type Fabrikam Encryption. Click Submit, and then click Yes in Web Access Confirmation dialog box.
On the Certificate Issued page, click Install this certificate.
Repeat steps 1-7, changing the information in the Name box in the Identifying Information section and the Friendly Name box to Contoso Encryption.
To generate the Contoso and Fabrikam Signing Certificates
In Internet Explorer, locate and open http://<contoso_computername>/certsrv.
On the Welcome page, click Request a certificate.
On the Request a Certificate page, click advanced certificate request.
On the Advanced Certificate Request page, click Create and submit a request to this CA.
On the Advanced Certificate Request page, do the following:
Use this To do this Name Type Fabrikam Signature. E-Mail Type jdoe@fabrikam.com. Company Type Fabrikam. Department Type Test. City Type Test. State Type Test. Country/Region Type US. Type of Certificate Needed Select E-Mail Protection Certificate.from the drop down list. Key Usage Select the Signature option. Additional Key Options Place a check in the following options:
- Mark keys as exportable
- Store certificate in the local computer certificate storeFriendly Name Type Fabrikam Signature. Click Submit, and then click Yes when asked to request the certificate.
On the Certificate Issued page, click Install this certificate.
Repeat steps 1-7, changing the information in the Name box in the Identifying Information section and the Friendly Name box to Contoso Signature.
To generate private certificates for the Encryption and Signature certificates
Click Start, click Run, type MMC, and then click OK.
In the Console1 window, on the File menu, click Add/Remove Snap-in.
In the Add/Remove Snap-in dialog box, on the Standalone tab, click Add.
In the Add Standalone Snap-in dialog box, select the Certificates snap-in from the Available Standalone Snap-ins list, and then click Add.
In the Certificates snap-in dialog box, select My user account, and then click Next.
In the Select Computer dialog box, click Finish.
In the Add Standalone Snap-in dialog box, click Close.
In the Add/Remove Snap-in dialog box, click OK.
In the Console1 window, expand Certificates (Local Computer), expand Personal, and then click Certificates.
In the right pane, right-click the Fabrikam Encryption certificate, point to All Tasks, and then click Export.
On the Welcome to the Certificate Export Wizard page, click Next.
On the Export Private Key page, select Yes, export the private key, and then click Next.
On the Export File Format page, make sure that Personal Information Exchange is the only option selected, and then click Next.
On the Password page, in the Password and Confirm Password boxes, type mysecret, and then click Next.
On the File To Export page, click Browse.
In the Save As dialog box, save the certificate using the file path <drive>:\Certs\Fabrikam Private Encryption.pfx.
On the File to Export page, click Next.
On the Completing the Certificate Export Wizard page, click Finish.
In the Certificate Export Wizard popup indicating a successful export, click OK.
Repeat steps 10-19 for the Fabrikam Signature certificate using the file name Fabrikam Private Signature.pfx.
Repeat steps 10-19 for the Contoso Signature and Contoso Encryption certificates using the file names Contoso Private Signature.pfx and Contoso Private Encryption.pfx, respectively.
To generate public certificates for the Encryption and Signature certificates
In the Console1 window, expand Certificates – Current User, expand Personal, and then click Certificates.
Right-click the Fabrikam Encryption certificate, point to All Tasks, and then click Export.
On the Welcome to the Certificate Export Wizard page, click Next.
On the Export Private Key page, select No, do not export the private key, and then click Next.
On the Export File Format page, click Next.
On the File To Export page, click Browse.
In the Save As dialog box, enter <drive>:\Certs for Save in, Fabrikam Public Encryption.cer as File name, and *.cer for Save as type, and then click Save.
On the File to Export page, click Next.
On the Completing the Certificate Export Wizard page, click Finish.
In the Certificate Export Wizard popup indicating a successful export, click OK.
Repeat steps 1-9 for the Fabrikam Signature certificate using the file name Fabrikam Public Signature.cer.
Repeat steps 1-9 for the Contoso Signature and Contoso Encryption certificates using the file names Contoso Public Signature.cer and Contoso Public Encryption.cer, respectively.