Working with SSL Certificates - Revision history

Ltalaschus: /* Optional: Creating a PFX Container with OpenSSL/LibreSSL */

2024-11-06T13:35:51Z

Optional: Creating a PFX Container with OpenSSL/LibreSSL

Ltalaschus: /* Importing an Existing Certificate */

2024-11-06T13:32:01Z

Importing an Existing Certificate

Ltalaschus: /* Optional: Creating a PFX Container with OpenSSL/LibreSSL */

2020-11-23T10:45:25Z

Optional: Creating a PFX Container with OpenSSL/LibreSSL

Ltalaschus: /* Optional: Creating a PFX Container with OpenSSL/LibreSSL */

2020-11-23T10:43:45Z

Optional: Creating a PFX Container with OpenSSL/LibreSSL

Ltalaschus: /* Optional: Creating a PFX Container with OpenSSL/LibreSSL */

2020-11-23T10:32:33Z

Optional: Creating a PFX Container with OpenSSL/LibreSSL

Ltalaschus: /* Importing a PFX container */

2020-11-23T10:31:18Z

Importing a PFX container

Bmeyn at 09:08, 17 June 2019

2019-06-17T09:08:48Z

Ltalaschus at 12:07, 8 June 2018

2018-06-08T12:07:21Z

Ltalaschus: /* Importing a PFX container */

2018-06-08T12:01:41Z

Importing a PFX container

Ltalaschus: /* Importing a PFX container */

2018-06-08T11:59:06Z

Importing a PFX container

@@ Line 106: / Line 106: @@
 * Create the PFX container by executing the following command, adjust the file names if necessary:
   openssl pkcs12 -export -out certificate.pfx -inkey private_key.key -in certificate.crt -certfile chain_bundle_file.crt
-* In some case the created PFX container is not compatible with the Windows system and the import fails with a password error, even when the password is correct. In that case, append the ''--legacy'' parameter to the command:
+* In some case the created PFX container is not compatible with the Windows system and the import fails with a password error, even when the password is correct. In that case, append the ''-legacy'' parameter to the command:
   openssl pkcs12 -export -out certificate.pfx -inkey private_key.key -in certificate.crt -certfile chain_bundle_file.crt -legacy

@@ Line 106: / Line 106: @@
 * Create the PFX container by executing the following command, adjust the file names if necessary:
   openssl pkcs12 -export -out certificate.pfx -inkey private_key.key -in certificate.crt -certfile chain_bundle_file.crt
 === Importing a PFX container ===

@@ Line 105: / Line 105: @@
 * Open an elevated command prompt and navigate to this directory.
 * Create the PFX container by executing the following command, adjust the file names if necessary:
-  openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile chain_bundle_file.crt
+  openssl pkcs12 -export -out certificate.pfx -inkey private_key.key -in certificate.crt -certfile chain_bundle_file.crt
 === Importing a PFX container ===

@@ Line 96: / Line 96: @@
 === Optional: Creating a PFX Container with OpenSSL/LibreSSL ===
-When the original CSR was not created with Windows' own tools or not even created on a Windows computer, it is unlikely that the private key or the vertificate is available in Windows' certificate store of the MailStore Server computer, but on stored on the file system instead.
+When the original CSR was not created with Windows' own tools or not even created on a Windows computer, it is unlikely that the private key or the certificate is available in Windows' certificate store of the MailStore SPE computer, but stored on the file system instead.
-In this case, a Personal Information Exchange (PFX) container need to be created first. This needs to contain the certificate, private key, and all certificates of the certificate chain. After that, the PFX container can by imported into Windows' certificate store.
+In this case, a Personal Information Exchange (PFX) container needs to be created first. This container holds the certificate, private key, and all certificates of the certificate chain. After that, the PFX container can by imported into Windows' certificate store.
-The following steps need to be executes to convert the certificate files into a PFX container with OpenSSL or LibreSSL:
+The following steps need to be executed to convert the certificate files into a PFX container with OpenSSL or LibreSSL:
 * Copy the certificate, private key and the certificates of the certificate chain into the OpenSSL or LibreSSL directory.

@@ Line 105: / Line 105: @@
 * Open an elevated command prompt and navigate to this directory.
 * Create the PFX container by executing the following command, adjust the file names if necessary:
-  openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crt
+  openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile chain_bundle_file.crt
 === Importing a PFX container ===

@@ Line 110: / Line 110: @@
 * Open an elevated command prompt and navigate into the directory where the PFX container resides.
 * Enter the following command to import the certificate into the personal store of the machine account, adjust the certificate file name if necessary:
-  certutil -enterprise -importpfx my certificate.pfx
+  certutil -importpfx -enterprise my certificate.pfx
 * Enter the password which is used to protect the PFX file.
 * Certutil shows a success message when the certificate was imported successfully.

@@ Line 3: / Line 3: @@
 Service Providers who already possess certificates and/or manage their certificates with OpenSSL/LibreSSL, find useful information in [[#Importing an_Existing_Certificate|Importing an Existing Certificate]].
-== Creating a New Certificate ==
+== Creating or Renewing a Certificate ==
+Follow the below instructions to create or renew a certificate and import it into Windows' certificate store.
 === Generating a Certificate Signing Request (CSR) ===

@@ Line 105: / Line 105: @@
 * Copy the certificate, private key and the certificates of the certificate chain into the OpenSSL or LibreSSL directory.
 * Open an elevated command prompt and navigate to this directory.
-* Create the PFX container by executing the following command, adjust the file names of necessary:
+* Create the PFX container by executing the following command, adjust the file names if necessary:
   openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crt
 === Importing a PFX container ===
-* Open a command prompt as administrator.
+* Open an elevated command prompt and navigate into the directory where the PFX container resides.
-* Navigate into the directory where the PFX container resides.
+* Enter the following command to import the certificate into the personal store of the machine account, adjust the certificate file name if necessary:
   certutil -enterprise -importpfx my certificate.pfx
 * Enter the password which is used to protect the PFX file.
@@ Line 117: / Line 116: @@
 == Weblinks ==
-* [https://technet.microsoft.com/en-us/library/dn296456.aspx Microsoft Technet: Certreq]
+* [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certreq_1 Microsoft Technet: Certreq]
-* [https://technet.microsoft.com/en-us/library/cc732443.aspx Microsoft Technet: Certutil]
+* [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil Microsoft Technet: Certutil]
-* [https://technet.microsoft.com/de-de/library/ff625722.aspx Microsoft Technet: How to Request a Certificate With a Custom Subject Alternative Name]
+* [https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff625722(v=ws.10) Microsoft Technet: How to Request a Certificate With a Custom Subject Alternative Name]
 * [https://www.libressl.org/ LibreSSL]
 * [https://www.openssl.org/docs/apps/openssl.html OpenSSL Documentation]

@@ Line 109: / Line 109: @@
 === Importing a PFX container ===
-* Open the MailStore Server Service Configuration.
+* Open a command prompt as administrator.
-* Select ''IP Addresses and Ports''.
+* Navigate into the directory where the PFX container resides.
-* In the section you want to change to certificate for, click on the button next to the ''Server Certificate'' field and select ''Import from file...''
+* Type ''certutil -enterprise -importpfx my <certificatename.pfx>''
-* Choose the PFX file.
+* Enter the password which is used to protect the PFX file.
-* If the PFX file has been password protected, you are being ask to provide the password now.
+* Certutil shows a success message when the certificate was imported successfully.
 == Weblinks ==