Re: Generate/Export PKCS #12 certificate from Win2k3 CA

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 01/08/05 

Date: Sat, 8 Jan 2005 14:09:49 -0600

Windows 2003 CA would be able to do what you want. The .pfx file is the one
you need as it will include the private key. See the link below for more
info.

http://www.microsoft.com/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/sag_CMimportExport.asp
http://tinyurl.com/532uy -- same link as above shorter.

The .cer file contains only the public key and my be useful if you need to
import/export the issuing CA certificate to the trusted root certificate
store on the client computer via the computer or user mmc certificates
snapin/trusted root folder - import. Just clicking a .cer or .pfx file will
start the installation wizard but you want to verity that the certificate is
installed in the correct store - user or computer.

When you export the private key you will need to use a password to protect
the sensitive private key in the .pfx file. Also select the option to export
all certificates in the chain which may make installing the CA certificate
easier. Keep in mind that user certificates are used for "user"
authentication and if your VPN client is l2tp you probably need a "computer"
certificate as l2tp requires certificate computer authentication in addition
to user authentication. --- Steve

"Stuart Mackie [MCP, MSP]" <newsgroups@--REMOVE_THIS-NO_SPAM--stu.uk.com>
wrote in message news:eTvs5tb9EHA.3616@TK2MSFTNGP11.phx.gbl...
> Hi. I am using a 3rd party VPN client which requires a PKCS #12
> certificate (*.p12) for use with RSA-Cert VPN connections. So far I have
> generated a certificate on our Win2k3 CA using the User Certificate
> Template, enabled 'Mark keys as exportable' and enabled strong private key
> protection. The request format is set for CMC and the Hash is SHA-1.
>
> Following this I can export two files, one is the .cer and the other is
> .pvk (private key). The format required for the VPN client (from what
> I've been informed so far) is PKCS #12 which would be .p12. I haven't
> managed to find much documentation online which explains the different
> file types, since I thought the .cer included PKCS #12.
>
> Is it possible to export the required .p12 certificate from a Win2k3 CA ?
>
> Thanks for any help,
> Stuart.
>

Relevant Pages

  • Re: Generate/Export PKCS #12 certificate from Win2k3 CA
    ... import/export the issuing CA certificate to the trusted root certificate ... Just clicking a .cer or .pfx file will ... When you export the private key you will need to use a password to protect ... authentication and if your VPN client is l2tp you probably need a "computer" ...
    (microsoft.public.windows.server.general)
  • Re: UsernameOverTransportSecurity+SSL Confusion, please help
    ... How come the authentication is not working there? ... you can buy a certificate in one of the well-know certificate ... I will have a private key on the server, and I will give the private key to ... The client will automatically get the public key and negotiate a key to ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Client Certificates
    ... I hope you are talking about exporting the pfx file on the CLIENT machine ... The way PKI certificate generation usually works is the following: ... - CA signs that information (i.e. encrypts the hash of that info with its own private key) ...
    (microsoft.public.security)
  • Re: Root CA Certificate vs Client Cert Expiration
    ... When a certificate is renewed you have a couple of options. ... with the same private key or with a new private key. ... If you renew with the same private ... the .pfx file contains the certificate and private key. ...
    (microsoft.public.security)
  • Re: Schannel client authentication problem with optional client certificate
    ... How can I force the ISC not to use the token? ... authentication. ... certificate which is linked to it. ... is use the private key is selected for authentication. ...
    (microsoft.public.platformsdk.security)