Knowledge Base

Overview

This procedure uses the built-in Windows certreq utility to generate a PKCS#10 Certificate Signing Request (CSR). Create a request configuration file, update the certificate subject information, and then generate the CSR from the command prompt.

Prerequisites

• Administrative access to a Windows server or workstation.
• Access to a text editor such as Notepad.
• Certificate subject details, including the Common Name (CN).
• Permission to generate certificate requests on the system.

Procedure

Step 1: Create the Request Configuration File

Save the following content as request.inf on your server. Update the Subject value before generating the CSR.

;----------------- request.inf -----------------

[Version]
Signature="$Windows NT$"

[NewRequest]
Subject = "C=US, CN=something.example.com"
KeySpec = 1
KeyLength = 2048
Exportable = TRUE
MachineKeySet = TRUE
SMIME = False
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0
HashAlgorithm = SHA256

[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1

; this is for Server Authentication / Token Signing

;-----------------------------------------------

Step 2: Generate the CSR

Open Command Prompt and run the following command:

C:\> certreq -new request.inf request.csr

The command generates a CSR file named request.csr, which can be submitted to your Certificate Authority (CA).

Expected Result

A valid PKCS#10 Certificate Signing Request (CSR) is generated and saved as request.csr.

Related Articles

• How to enable LDAP over SSL with a third-party certification authority
• Certreq Documentation

Additional Information

The Enhanced Key Usage OID 1.3.6.1.5.5.7.3.1 is used for Server Authentication and Token Signing scenarios.