Creating a Key and Requesting a Certificate

Now the CA has been set up to issue PGP User certificates, we can enroll it and one can create a key and request a certificate.

1. Open the certmgr.msc from the location C:\Windows\SysWow64.

2. In the Microsoft Management Console that appears, right-click on the Personal folder and select All Tasks Request New Certificate…

3. Click Next, select Active Directory Enrollment Policy and then click Next. It will show the certificate template that has been configured, i.e. PGP User.

4. Click on Details and then Properties.

5. The Certificate Properties window will open. Select the Subject tab.

6. Select Common Name under Subject Name and provide the fully qualified domain name for the computer on which you are installing the certificate in the Value field. Click Add.

7. Click on General tab and provide the Friendly Name. For example, PGP User.

8. Click on Private Key tab, and ensure that RSA, Utimaco CryptoServer Key Storage Provider is selected as cryptographic service provider (CSP).

Certificate Properties

9. Click on Certificate Authority tab and make sure that Enterprise Root CA is selected.

10. Click Apply and then OK.

11. Select the PGP User certificate template and click Enroll.

Certificate Enrollment

12. When enrollment has succeeded, click Finish.

13. Make sure that the PGP User certificate is now available in the Personal Certificate store.

14. Double click on the certificate and see the You have a private key that corresponds to this certificate message.

Certificate

15. The keys for this certificate have been generated on the CryptoServer. You can list the keys on the CryptoServer by means of invoking the cngtool ListKeys command from the command prompt.