Step 1: Creating a Certification Authority
In this topic, you install the Certificate Services Windows component. You use it to generate the certificates that you need to promote secure communication between the Contoso and Fabrikam organizations. Each trading partner will have a private encryption certificate for communication and a private signature certificate for identification purposes. Additionally, the partners will share their public key certificates with each other to promote secure communication when implementing the 3A2 Partner Interface Process (PIP).
To install the certificate server
Click Start, point to Settings, and then click Control Panel. Double-click Add or Remove Programs.
In the Add or Remove Programs dialog box, click Add/Remove Windows Components.
On the Windows Components Wizard page, in the Components section, select Certificate Services, click Yes, and then click Next to start the Configuring Components Wizard.
Note
If the Certificates ServicesWindows component is already selected, skip the rest of this procedure.
On the CA Type page, make sure that Stand-alone root CA is selected, and then click Next.
On the CA Identifying Information page, in the Common name for this CA box, type Contoso-FabrikamCA, and then click Next.
On the Certificate Database Settings page, leave the defaults, and then click Next.
Click Yes when the wizard prompts you to stop Internet Information Services (IIS).
Click Yes if the Configuring Components Wizard prompts you to enable Active Server Pages.
Click Finish to close the Windows Components Wizard.
Note
You only have to use one computer as the Certification Authority. You do not have to repeat this step on the second computer. This tutorial uses the Contoso computer as the Certification Authority.
To install a root Certification Authority (CA) for Windows Server 2008
Open Server Manager, click Add Roles in Roles, click Next, and click Active Directory Certificate Services check box. Click Next twice.
On the Select Role Services page, click Certification Authority and Certification Authority Web Enrollment. Click Next.
On the Specify Setup Type page, click Standalone. Click Next.
On the Specify CA Type page, click Root CA. Click Next.
On the Set Up Private Key page, click Create a new private key. Click Next.
On the Configure Cryptography for CA page. Click Next.
On Configure CA Name, in the Common name for this CA box, type Contoso-FabrikamCA, and then click Next.
On the Set Validity Period page, click Next.
On the Configure Certificate Database page, Click Next.
On the Confirm Installation Options page, click Install.
Configuring the Web site for the CA to use HTTPS authentication
On the computer you used as the Certification Authority, click Start, point to All Programs, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.
In the Internet Information Services (IIS) Manager dialog box, right click Default Web Site and select Edit Bindings… from the popup menu.
In Site Bindings dialog box click Add.
In Add Site Binding dialog box select https in Type drop down, select the certificate from SSL certificate drop down and click OK.
Click Close to close the Site Bindings… dialog box.
To download the CA certificate
In Internet Explorer, locate and open http://<contoso_computername>/certsrv/Default.asp.
On the Default.asp page, click Download a CA certificate, certificate chain, or CRL.
Make sure that Current[Contoso-FabrikamCA] is selected in the CA Certificate list, and then click Download CA Certificate.
Save the certificate to C:\Certs\Contoso-FabrikamCA.cer on both the Contoso and the Fabrikam computer.
To import the CA certificate to the Trusted Root Certification Authorities store
Click Start, click Run, type cmd, and then click OK.
At the command prompt, move to <drive>:\Program Files\MicrosoftBizTalk <version> Accelerator for RosettaNet\SDK, and then press Enter.
At the command prompt, type CertWizard /Rootkey "<drive>:\Certs\Contoso-FabrikamCA.cer", and then press Enter.
Important
Perform this procedure on both the Contoso and Fabrikam computers.
To enable automatic certificate issuing
On the computer you used as the Certification Authority, click Start, point to Programs, point to Administrative Tools, and then click Certification Authority.
In the Certification Authority dialog box, right-click Contoso-FabrikamCA, and then click Properties.
In the Contoso-FabrikamCA Properties dialog box, on the Policy Module tab, click Properties.
In the Properties dialog box, select Follow the settings in the certificate template, and then click OK.
Click OK to close the Contoso-FabrikamCA dialog box.
Close the Certification Authority dialog box.
Note
By enabling automatic certificate issuing, Certificate Services automates the certificate issuing procedure. You will have to restart Certificate Services to apply this change.
You may need to install the Root Certificate Contoso-FabrikamCA.cer in the Current User\Trusted Root Certification authorities.