Creating certificates
Updated: February 1, 2011
Applies To: Forefront Threat Management Gateway (TMG)
Server authentication certificates for authentication are required by Lightweight Directory Access Protocol (over SSL) - (LDAPS), which is the protocol used for communication between the configuration storage server and the Forefront TMG servers in a workgroup deployment.
The certificate must be installed as a personal certificate of the ADAM_ISASTGCTRL service on the configuration storage server. The certificate must be installed during or after Forefront TMG installation. The certificate subject must be the FQDN of the configuration storage server in order for the certificate to be accepted by the other Forefront TMG servers. After installing the certificate on the configuration storage server, the CA certificate must be installed on the other servers in the ‘Local Computer’ certificates store under ‘Trusted Root Certification Authorities’. You can create a certificate using your own CA, or obtain a certificate from a global CA. When the certificates are for internal use, it is recommended that you create a local CA, negating the need to purchase a commercial certificate.
The following procedures describe how to create a server certificate and how to export it.
Creating a server certificate
To create a server certificate
On the CA computer, browse to: https://localhost/certsrv.
Click Request a certificate.
Select Advanced Certificate Request.
Select Create and submit a request to this CA.
Under Name, provide a name for the certificate. To avoid the client receiving an error when trying to connect, it is critical that the common name you provide for the certificate matches the server name. In common name, type the fully qualified host name for the configuration storage server on which the certificate will be installed, such as server01.east.fabrikam.com.
Complete the form and select Server Authentication Certificate from the Type drop-down list.
Select Mark keys as exportable.
Select Store Certificate in the local computer certificate store or Use local machine store and submit the request by clicking Submit. Review the warning dialog box that appears, and then click Yes.
Click your request and choose Install this certificate.
Exporting the server certificate
To export the server certificate
From the Start menu, click Run. Type MMC, and then click OK.
In MMC, click File, and then click Add/Remove Snap-in.
In Add/Remove Snap-in, click Add to open the Add Standalone Snap-in dialog box. From the list of snap-ins, select Certificates, and then click Add.
In Certificates snap-in, select Computer account, and then click Next. In Select Computer, verify that Local computer (the default) is selected, and then click Finish. Click Close, and then click OK.
In the MMC console, expand Certificates (Local Computer), expand Personal, and click Certificates.
In the details pane, right-click the certificate you just created (it shows the fully qualified domain name (FQDN) of the configuration storage server), point to AllTasks, and select Export.
On the Welcome page of the Certificate Export Wizard, click Next.
On the Export Private Key page, select Yes, export the private key, and then click Next.
On the Export File Format page, select Include all certificates in the certification path if possible, leave the other default settings, and then click Next.
On the Password page, you may provide and confirm a password, and then click Next.
On the File to Export page, click Browse, and browse to a location where you want to store the exported certificate file. This can be any location from which the file can be easily retrieved by Forefront TMG installation when installing Forefront TMG services which includes the configuration storage server. Click Next.
On the summary page, click Finish.
Close MMC. Save the console settings with a descriptive name, such as LocalCertificates.
Related Topics
Concepts
Preparing for installation in a workgroup environment
Overview of authentication in Forefront TMG