Generating a certificate at a Certification Authority

These instructions are applicable to a Microsoft Certification Authority deployed on Windows Server 2016.

It is recommended to use the Internet Explorer browser. Other browsers may incorrectly display some pages of the Microsoft Certification Authority.

To generate a PFX certificate with a private key:

1. In a browser, open the page of your Certification Authority: https://<server address>/certsrv.
2. Select Request a certificate.

   The Request a certificate page opens.

3. Select advanced certificate request.

   The Advanced Certificate Request page opens.

4. Select Create and submit a request to this CA.

   The Advanced Certificate Request page opens.

5. In the Certificate Template drop-down list, select Subordinate Certification Authority.
6. In the Identifying Information For Offline Template settings group, fill in your company information.

   The Name field is required.

7. In the Key Options settings group:
   1. Select the Create new key set option.
   2. In the Key Size field, enter the value 2048.
   3. Select the Automatic key container name option.
   4. Select the Mark keys as exportable check box.
8. In the Additional Options settings group, make sure that the Save request check box is cleared.
9. Click Submit.

   The Certificate Issued page opens.

10. Select Install this certificate.

A certificate with a private key will be generated and stored in the certificate storage of your user account.