Knowledge Base

Overview

This article explains how to create a Certificate Signing Request (CSR) in Internet Information Services (IIS) 7.x so you can order an SSL/TLS certificate from Sectigo. A CSR is an encoded text block that contains your domain and organization details. You submit it to a Certificate Authority (CA) when you enroll for a certificate. The article covers the prerequisites and the Request Certificate wizard steps, including the Distinguished Name Properties and Cryptographic Service Provider Properties windows. It also covers how to submit the CSR and how to back up the private key that IIS creates with the request.

Prerequisites

• Administrator access to the Windows server that runs IIS 7.x.
• The Fully Qualified Domain Name (FQDN) that the certificate will protect, for example www.example.com .
• Your organization's legal name, department, city, state or province, and country.

Steps

Step 1: Open Server Certificates in IIS Manager

1. Click Start, select Administrative Tools, and open Internet Information Services (IIS) Manager.
2. In the Connections pane, click the server name.
3. In the center pane, in the IIS section, double-click Server Certificates.
    

                             Figure 1: IIS Manager server home page with the Server Certificates feature in the IIS section

4. In the Actions pane on the right, click Create Certificate Request. The Request Certificate wizard opens.
   
    

                         Figure 2: Server Certificates page with Create Certificate Request highlighted in the Actions pane

Step 2: Enter the Distinguished Name Properties

In the Distinguished Name Properties window, enter the following details, and then click Next.

Field	What to enter
Common name	The FQDN the certificate will protect, for example www.example.com . For a wildcard certificate, start with an asterisk, for example *.example.com.
Organization	Your organization's full legal name.
Organizational unit	Your department, for example IT or Web.
City/locality	The full city name. Do not use abbreviations.
State/province	The full state or province name. Do not use abbreviations.
Country/region	Your two-letter country code, for example US.

Important: The common name must exactly match the domain name that you plan to secure. If it does not match, the certificate will not work for that domain.

 

Figure 3: Request Certificate wizard Distinguished Name Properties window with sample organization details

Step 3: Set the cryptographic properties

In the Cryptographic Service Provider Properties window, keep the default provider, Microsoft RSA SChannel Cryptographic Provider. Set Bit length to 2048, and then click Next.

Figure 4: Cryptographic Service Provider Properties window with the Microsoft RSA SChannel provider and 2048 bit length

Step 4: Save the CSR file

Enter a file name and location for the CSR, for example C:\certreq.txt, and then click Finish. IIS saves the CSR to this file.

             Figure 5: Request Certificate wizard File Name window with the CSR saved as c:\certreq.txt

Step 5: Submit the CSR to Sectigo

1. Open the CSR file in a text editor, such as Notepad.
2. Copy the full content, including the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines.
3. Paste the content into the CSR field of the Sectigo enrollment form, click Next, confirm your details, and click Finish.

Step 6: Back up the private key (recommended)

IIS creates the private key on the server when it creates the CSR. Back up the key, especially if you plan to make changes to the site.

1. Open the Certificates snap-in in the Microsoft Management Console (MMC).
2. Select Requests.
3. Right-click the request, select All Tasks, and then select Export.
4. Follow the export wizard, set a password, and save the backup file to secure removable media.

Important: Store your password securely and back up your private key. Sectigo cannot recover either item if it is lost.

Verify

• The CSR file opens in a text editor and starts with -----BEGIN CERTIFICATE REQUEST-----.
• The pending request appears under Requests in the Certificates snap-in.
• Sectigo accepts the CSR in the enrollment form without errors.

Troubleshooting

Problem	Likely cause	Action
The enrollment form rejects the CSR.	Part of the CSR text is missing.	Copy the full CSR again, including the BEGIN and END lines.
The certificate does not secure the domain.	The common name does not match the domain.	Create a new CSR with the correct FQDN and reissue the certificate.
The certificate cannot be installed after issuance.	The private key was deleted or the requestate a new CSR and reissue the certificate.