SSL/TLS - Signing Certificates With A Microsoft Certificate Authority

Overview

This KB article shows you how you can sign your SSL/TLS certificates with a Microsoft Certificate Authority (CA). This article compliments our product specific documentation for configuring SSL/TLS.

Why would you want to do this? When you create self-signed certificates they are not trusted by your web browser and produce warning messages. When a Windows computer is a member of an Active Directory (AD) domain, Internet Explorer will trust certificates signed by the CA(s) in that domain and hence will not produce warnings.

Requirements

This KB article assumes that you have been following the product specific documentation for configuring SSL/TLS an requires you to be in the root users home directory. If you are not in this directory execute the following command:

cd ~

Get Certificate Request

In the product specific documentation for configuring SSL/TLS you would have executed the following command:

openssl req -new -key keyfile.key -out certrequest.csr

You will have completed all of the fields and this will create the certrequest.csr file. Execute this command to display the contents of the request:

cat certrequest.csr

This will output something like this:

The following step will require you to provide this request.

Sign Using Web Interface

The Microsoft CA has a web interface available to use for signing certificate requests. This can be accessed by navigating to the following address in your web browser:

http://ca_server_address/certsrv

You will need to provide valid credentials to access the website.

You will be presented with the Welcome page. Click the Request a certificate link.

Click the advanced certificate request link.

In the Saved Request field paste the certificate request, including the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines.

In the Certificate Template drop down list select Web Server.

Click the Submit button.

The certificate will be signed and issued. Select Base 64 encoded and then click the Download certificate link.

You web browser will prompt you to download a file called certnew.cer which you can save. You will need to open this file in a text editor such as Notepad and will appear something like:

Saving or transferring this certificate to your Nagios server is covered in the Save Certificate On Nagios Server section of this KB article.

Sign Using certreq.exe

If you are unable to use the web interface to sign the certificate, you can use the certreq.exe program instead. Login to the Windows server that has the Certification Authority role installed.

The certrequest.csr file from the Nagios server will need to be transferred to this server, you will not be able to paste the request into a form. You can however simply paste the contents into a Notepad file and save it somewhere (the desktop perhaps) with the name of certrequest.csr.

Open a command prompt as an administrator and execute the following commands:

cd %HOMEPATH%\Desktop
certreq.exe -submit -attrib "CertificateTemplate: WebServer" certrequest.csr certfile.crt

This will prompt you which Certification Authority server you want to submit the request to. Select the appropriate one and click OK.

A certificate will be issues and saved to the desktop with the name certfile.crt. You will need to open this file in a text editor such as Notepad and will appear something like:

Saving or transferring this certificate to your Nagios server is covered in the Save Certificate On Nagios Server section of this KB article.

Save Certificate On Nagios Server

The signed certificate needs to be saved to the Nagios server into the root users home directory with the filename of certfile.crt. Execute the following command on your Nagios server to create a new file on your Nagios server:

vi certfile.crt

When using the vi editor, to make changes press i on the keyboard first to enter insert mode. Press Esc to exit insert mode.

Paste the certificate text into the new file, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.

When you paste the certificate into vi, it's possible that blank lines are added between each line. You will need to remove these blank lines as they will cause the certificate file to break.

Save the changes in vi by typing:

:wq

and press Enter.

This completes the steps for signing a certificate with a Microsoft CA. You should now return to the product specific documentation for configuring SSL/TLS to complete the steps to implement this signed certificate.

If you run into validation issues, please see the article, SSL Certificate does not validate properly.

Final Thoughts

For any support related questions please visit the Nagios Support Forums at:

http://support.nagios.com/forum/

Article ID: 597
Created On: Wed, Jun 14, 2017 at 5:28 PM
Last Updated On: Wed, Jan 20, 2021 at 10:56 AM
Authored by: tlea

Online URL: https://support.nagios.com/kb/article/ssl-tls-signing-certificates-with-a-microsoft-certificate-authority-597.html