Step 2: Generating a certificate request
Now that you have created a self-signed certificate, you want to request a signed certificate from a Certificate Authority, so that the certificate is more apt to be trusted by others.
To request the certificate:
- Execute the following command, typing it as one continuous string without including any return characters:
Where:
Generates a Certificate Signing Request (CSR).-certreq
Specifies the path to and name of the file that is generated to hold the certificate request information. Generally, the naming convention used to identify a CSR is to add-file d:\work\acme.csr
.csr
to the end of the file name. In the example shown here, the file isd:\work\acme.csr
.The CA will typically authenticate you as the requestor and return a certificate, signed by the CA, authenticating your public key.- Submit the certificate request to a Certificate Authority (or to your own company's certificate authority, such as Microsoft's Certificate Authority). The submittal of the request is usually done by copying the contents of the file into the appropriate field into a Web page generated by your chosen certificate authority's Web site; however, the process for submitting the CSR is dependent upon the certificate authority.
In this case, the CA will actually return a chain of certificates; each certificate authenticates the public key of the signer of the previous certificate in the chain.- When you receive the reply (usually sent by e-mail), copy the contents starting with ---Begin Certificate and ending with --- End Certificate into a file with a
.cer
extension.If necessary, obtain the CA's root certificate from your certificate authority to use in your browser and for remote trending. This certificate is used on the client side (browser) to authenticate the root signer and also needs to be added to the certificate keystore file. If the CA certificate is from a well-known authority such as Verisign, then it may not be necessary to install the CA certificate into the client-side browser as most browsers already include support for well-known certificate authorities. If the CA is not one that is included in the- Download the CA's root certificate for use in the Web server identity keystore.
trendtrustkeystore.zip
, you must get the CA's certificate and add it. You must now update the keystore file (created in the "Step 1: Creating a keystore repository" section) by importing the CA certificate and your new site certificate.
Copyright © 2008 Progress Software Corporation www.progress.com Voice: (781) 280-4000 Fax: (781) 280-4095 |