For å generere en CSR med en ny privatnøkkel kjør følgende kommando:

openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privatekey.key

Parameter forklaring:

-out spesifiserer filnavn og hvor CSR-en lagres.
-new -newkey rsa:2048 detaljer rundt privatnøkkel, rsa:2048 beskriver størrelsen (bit) på privatnøkkelen. 2048 er minimum.
-nodes om du ikke ønsker at privatnøkkelen skal krypteres (3DES), fjerner du -nodes vil du måtte lage et passord for å dekryptere privatnøkkelen
-keyout filnavn og plassering av privatnøkkelen

Når du kjører kommandoen vil OpenSSL be om følgende:

Country Name: (2 bokstavs ISO-3166-1 landskoden, f.eks. NO for Norge)
State or Province: (Fylke)
Locality: (Poststed)
Organization: (Fulle juridiske organisasjonsnavn som står i Brønnøysundsregistrene.
Common Name: (FQDN / domene)

 

 

 

Open Internet Information Services (IIS) Manager.

 

In IIS select the server from the Connection menu. On chose the Select Server Home, double-tap Server Certificates.

 

A new overview showing available certificates will appear. In the right margin under Actions, press Create Certificate Request.

 

A Request Certificate wizard will open where the following information must be entered (bold means mandatory):

 

Common name (CN):

Fully-qualified domain name (FQDN) (eg, www.example.com). If certificates are a wildcard certificate, ‘*’ must be in the common name.

Organization (O):

Full legal name as stated in the Brønnøysund Register.

Organizational Unit (OU):

Department and the like May be blank, just be sure to avoid entering “big” brand names like Google, Microsoft etc.

City / locality:

City / City where the organization is registered in Brønnøysund Registers.

State / Province:

county

Country:

Country (NO for Norway).

 

 

The next step, Cryptographic Service Provider Properties, if you do not know what to use, select Microsoft RSA SChannel Cryptographic Provider and a minimum bit length (key size) by 2048.

 

 

 

Then select where the CSR is to be saved. The end result will be a .csr or .txt file we need to produce a certificate.

 

The CSR looks like this:

 

–BEGIN CERTIFICATE REQUEST–

MIIDOjCCAiICAQAwgaMxCzAJBgNVBAYTAk5PMQ0wCwYDVQQIDARPc2xvMQ0wCwYD

VQQHDARPc2xvMRswGQYDVQQKDBJDb21tZmlkZXMgTm9yZ2UgQVMxEzARBgNVBAsM

Ck9wZXJhdGlvbnMxGzAZBgNVBAMMEmVwa2kuY29tbWZpZGVzLmNvbTEnMCUGCSqG

SIb3DQEJARYYb3BlcmF0aW9uc0Bjb21tZmlkZXMuY29tMIIBIjANBgkqhkiG9w0B

AQEFAAOCAQ8AMIIBCgKCAQEArn0EXXmQcm4GL9KuvBNbeYTBNjEVZTd2M20EmrBC

G80eSd4JNGukLt + TVAtX5a9n99ohVxYLeRMGtccqvPh + psgM23btZAJ6 + vRtSF + l

kp9ACqCTGyd8uwQoa6ZtTTDGfkyS3o7dkAFmlvFzgGQShFSy2S6QDl + A + Ey9Q7Zr

aLF2UN + z8qy76xcPuSdzuog8KPx7tPP2 + AzNsIhh5F + KJbeBC06us / + pKy5URbqp

BtgYnXyKjrycdqizIeYEI4TBp0efOXbZnpdxyFD + WxsMb + 7VkxeRBZWL100NJTtI

k0pOuSBRhYyWlW1FMosXCx9Ln0kXRfM9SICzn96kYzLMRQIDAQABoFEwIAYJKoZI

hvcNAQkHMRMMEU5ld0NlcnRDbW1mZHMxMjMhMC0GCSqGSIb3DQEJAjEgDB5Qcm92

aWRlZCBieSBDb21tZmlkZXMgTm9yZ2UgQVMwDQYJKoZIhvcNAQELBQADggEBAAKh

plRy5dzGygewYqGnFoAXCOVPJdxsnkltnzZZ / WiDbXnkBEQjiiBD4YSZq + cnWwM /

2ip5yHE / x + 2Yp21Y + 5rR3 + b5Iq9 + m9Pg2VXCu3fzO45T7iFk96vw4UkS / 94ltjpI

2E1xB4Se + OWstdzGO8LdSohtdIESvTHc8kzcepU42yYDX7RG3h4LsQzGJtRrOCCD

CvJFQJYZ5 + 9xAcTQuG7DkDwg + PY3lhGgi7m8XMycCJuO + U6U4kvcVkerfjhbaTTj

qEGK2O65vZ3xlGhSD1y40fQtTiQPIKmfDyRV6yFra676EMHbWNsO7Y2lxSxrfkJ +

Ii0dmmJkIY + Fzl1sctY =

–END CERTIFICATE REQUEST—

1. Start the Exchange Management Console by going to Start> Programs> Microsoft Exchange 2010> Exchange Management Console.
2. Click Manage Databases.
3. Select Server Configuration in the left menu and then New Exchange Certificate from the action menu on the right side.
4. When asked for a friendly name, you are free to choose anything. This is not used in the CSR itself, but used by Windows to identify / separate on CSRs / certificates.
5. Under Domain Scope, check the box to generate wildcard CSR. Otherwise, just move on. NB Some systems may have problems with Wildcard (*) for Exchange / Federation. If you choose Wildcard, you can go straight to step 8.
6. In the Exchange Configuration menu, select the services / services to be secured with TLS / certificate, and enter the name of the services to be covered.
7. On the next page, Exchange lists all the names it proposes to be included in the CSR. Review the names and add any additional names on this point.
8. Your organization should be your full legal name as stated in the Brønnøysund Register.
9. In the next step, choose where you want to save the CSR file. This is saved as a .req file that can be opened in most text editors such as Notepad, Wordpad, Vi, etc.

Use this CSR file when you order the certificate.