Create Standalone Certificate request for #Lync/TMG 2010 Reverse Proxy
Posted by Chad McGreanor on July 6, 2011
Below are the steps to create a standalone certificate request from the TMG 2010 server in order to generate a CSR for a Public CA.
- Open Certificate MMC
- Expand Personal > Certificates
- Right – Click Certificates then All Tasks then Advanced Operations Then Create Custom Request
- Select Next
- Select Proceed without enrollment policy
- Select No template legacy Key
- Select Properties
- Enter a friendly name
- On the Subject tab enter the Common Name and Alternative names
- On the extensions tab under Key Usage choose Digital Signature and Key encipherment
- Under extended key usage choose Server Authentication and Client Authentication
- Under the private key tab under key options choose key size and select 2048 and select private key exportable
- Under Key type choose Exchange and ensure that the key size above is set to 2048
- Select OK, Choose path to save and provide the CSR to a Public CA and then import into the Personal store.
Advertisement
Rasmus said
Great post, exactly what I needed.
I submitted the CSR and got a CRT file back – only it didn’t contain the private key, so now I have a cert with the correct SANs but no private key.
Could you add to this post how to import the CA’s generated certificate?
Thank you.
Rasmus said
Never mind, I must have done something wrong the first time I tried. The second time, the certificate response from the CA could be imported by right-clicking the “Personal” folder in the Certificates snap-in and selecting Import. Once again thanks for a good guide.
Nick said
I love you!!!! I have been looking for this for weeks!!
Patrick Yore (@pyore) said
Hi Chad,
Great article, one thing I am trying to generate a csr for Comodo and I keep getting error saying “This CSR uses an unsupported key size!” even though I am selecting 2048 which is supported by Comodo. Would you have any ideas?
Chad McGreanor said
Sorry I do not. I use GoDaddy for all certificates.
Rasmus said
Patrick: I experienced that the Key size is reset to 1024 bits when changing Key Type to Exchange. You may be running into the same problem. Check that it is still 2048 bits before clicking OK.