Generating an IIS SSL Certificate Signing Request (CSR) using Microsoft IIS 5.x / 6.x
A CSR is a file containing your IIS SSL certificate application
information, including your Public Key. Generate your CSR and then copy
and paste the CSR file into the webform in the enrollment process:
Generate keys and Certificate Signing Request:
- Select Administrative Tools
- Start Internet Services Manager
- Open the properties window for the website the CSR is for.
You can do this by right clicking on the Default Website and selecting
Properties from the menu
- Open Directory Security by right clicking on the
Directory Security tab
- Click Server Certificate. The following Wizard will appear:
Note: If you do not see the above screenshot, you probably already have an SSL Certificate on the website you're using. Please follow these on how to create a CSR without removing the current certificate.
- Click Create a new certificate and click Next.
- Select Prepare the request and click Next.
- Provide a name for the certificate, this needs to be easily
identifiable if you are working with multiple domains. This is for your
- For Bit length please use 2048 and then Click Next
- Enter Organization and Organization Unit,
these are your company name and department respectively. Click Next.
- The Common Name field should be the Fully
Qualified Domain Name (FQDN) or the web address for which
you plan to use your IIS SSL Certificate, e.g. the area of your site
you wish customers to connect to using SSL. For example, an Instant SSL
Certificate issued for comodogroup.com will not be valid for
secure.comodogroup.com. If the web address to be used for SSL
is secure.comodogroup.com, ensure that the common name submitted
in the CSR is secure.comodogroup.com. For Wildcard SSL certificate the Common Name must contain at least one asterisks (*) Example: *.comodo.com, *.instantssl.com, etc.
- Click Next once you have entered the common name.
- Enter your Country, State and City, then click Next once this information is entered..
- Enter a filename and location to save your CSR. You will
need this CSR to enroll for your IIS SSL Certificate. Click Next.
- Check the details you have entered. If you have made a
mistake click Back and amend the details. Be especially sure
to check the domain name the Certificate is to be "Issued To".
Your IIS SSL Certificate will only work on this domain. Click Next
when you are happy the details are absolutely correct.
- When you make your application, make sure you include the
CSR in its entirety into the appropriate section of the enrollment form
-----BEGIN CERTIFICATE REQUEST-----to-----END CERTIFICATE REQUEST-----
- Click Next
- Confirm your details in the enrollment form
To save your private key:
- Go to: Certificates snap in in the MMC
- Select Requests
- Select All tasks
- Select Export
We recommend that you make a note of your password and
backup your key as these are known only to you, so if you loose them we
can't help! A floppy diskette or other removable media is recommended
for your backup files.
Backing up and Restoring the Pending Request (Key)