Certificates

This topic discusses certificates and the Certificates snap-in, which enables you to manage certificates for a user, computers, or services.

  • For help with specific tasks, see How to.
  • For general background information, see Concepts.


How to...

  • Add the Certificates snap-in to the MMC console
  • Set display options of the Certificates snap-in
  • Request certificates
  • Manage an individual certificate
  • Import and export certificates
  • Use Windows 2000 Certificate Services Web pages
  • Manage certificate trusts


Add the Certificates snap-in to the MMC console

  • Manage certificates for your user account
  • Manage certificates for a computer
  • Manage certificates for a service


Manage certificates for your user account

Microsoft Windows graphic

To manage certificates for your user account

  1. Click Start, click Run, type mmc, and then click OK.
  2. On the File menu, click Add/Remove Snap-in, and then click Add.
  3. Under Snap-in, double-click Certificates, and then:
    • If you are logged on as an administrator, click My user account, and then click Finish.
    • If you are logged on as a user, Certificates automatically loads.
  4. Click Close.

    Certificates – Current User appears on the list of selected snap-ins for the new console.

  5. If you have no more snap-ins to add to the console, click OK.
  6. To save this console, on the File menu, click Save.

Notes

  • To switch between managing certificates for your user account, a computer, or a service, you must have separate instances of Certificates added into the console.
  • For additional help with creating and using MMC consoles, on the Help menu, click Help Topics.

Related Topics


Manage certificates for a computer

To manage certificates for a computer

  1. Log on to the system as an administrator.
  2. Click Start, click Run, type mmc, and then click OK.
  3. On the File menu, click Add/Remove Snap-in, and then click Add.
  4. Under Snap-in, double-click Certificates, click Computer account, and then click Next.
  5. Do one of the following:
    • To manage certificates for the local computer, click Local computer, and then click Finish.
    • To manage certificates for a remote computer, click Another computer and type the name of the computer, or click Browse to select the computer name, and then click Finish.
  6. Click Close.

    Certificates (Computer Name) appears on the list of selected snap-ins for the new console.

  7. If you have no more snap-ins to add to the console, click OK.
  8. To save this console, on the File menu, click Save.

Notes

  • To manage certificates for another computer, you can either create another instance of Certificates in the console, or right-click Certificates (Computer Name) and click Connect to Another Computer.
  • For more information on creating and using MMC consoles, on the Help menu, click Help Topics.


Manage certificates for a service

To manage certificates for a service

  1. Log on to the system as an administrator.
  2. Click Start, click Run, type mmc, and then click OK.
  3. On the File menu, click Add/Remove Snap-in, and then click Add.
  4. Under Snap-in, double-click Certificates, click Service account, and then click Next.
  5. Do one of the following:
    • To manage certificates for services on your local computer, click Local computer, and then click Next.
    • To manage certificates for a remote computer, click Another computer and type the name of the computer, or click Browse to select the computer name, and then click Next.
  6. Click the service for which you are managing certificates.
  7. Click Finish, and then click Close.

    8. Certificates – Service (Service Name) on Computer Name appears on the list of selected snap-ins for the new console.

  8. If you have no more snap-ins to add to the console, click OK.
  9. To save this console, on the File menu, click Save.

Notes

  • To manage certificates for a service on another computer, you can either create another instance of Certificates in the console or right-click Certificates – Service (Service Name) on Computer Name and click Connect to Another Computer.
  • For additional help creating and using MMC consoles, click Help Topics on the Help menu.


Set display options of the Certificates snap-in

  • Display certificate stores in Logical Store mode
  • Display certificate stores in Purpose mode
  • Display the certificate stores storage structure
  • Display archived certificates


Display certificate stores in Logical Store mode

To display certificate stores in Logical Store mode

  1. Open Certificates.

    Where?

    • Console Root
    • Certificates – Certificate holder
    • Logical store
    • Certificates
  2. Click Certificates - Certificate Holder, where Certificate Holder is a Certificates instance (user, computer or service).
  3. On the View menu, click Options.
  4. Under Organize view mode by, click Logical Certificate Stores.

Note

  • To open Certificates, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. Then, in the console tree, click Certificates.
  • If you have not already created an MMC console that contains Certificates, see Related Topics.

  • When you look at the contents of a certificate store in Logical Store mode, you will occasionally see what appears to be two copies of the same certificate in the store. This occurs because the same certificate is stored in separate physical stores under a logical store, such as the Registry and Enterprise physical stores under the Trusted Root Certification Authorities logical store. When the contents of the physical certificates stores are combined into one logical store view, both instances of the same certificate are displayed.

    You can verify this by setting the view option to show the physical certificate stores and then noting that the certificate is stored in separate physical stores under the same logical store. You can verify that it is the same certificate by comparing the serial numbers.


Display certificate stores in Purpose mode

To display certificate stores in Purpose mode

  1. Open Certificates.
  2. In the console tree, click Certificates - Certificate Holder, where Certificate Holder is a Certificates instance (user, computer or service).
  3. On the View menu, click Options.
  4. Under Organize view mode by, click Certificate purpose.

Notes

  • To open Certificates, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. Then, in the console tree, click Certificates.
  • If you have not already created an MMC console that contains Certificates, see Related Topics.


Display the certificate stores storage structure

To display the certificate stores storage structure

  1. Open Certificates.
  2. In the console tree, click Certificates - Certificate Holder, where certificate holder is a Certificates instance (user, computer or service).
  3. On the View menu, click Options.
  4. Under Organize view mode by, click Logical Certificate Stores.
  5. Under Show the following, select Physical Certificate Stores.

Notes

  • To open Certificates, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. Then, in the console tree, click Certificates.
  • Displaying the certificate stores storage structure is recommended only for advanced users and developers.
  • If you have not already created an MMC console that contains Certificates, see Related Topics.


Display archived certificates

To display archived certificates

  1. Open Certificates.
  2. In the console tree, click Certificates - certificate holder, where certificate holder is a Certificates instance (user, computer or service).
  3. On the View menu, click Options.
  4. Under Show the following, select the Archived certificates check box.

Notes

  • To open Certificates, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. Then, in the console tree, click Certificates.
  • Archived certificates are certificates that have expired or have been renewed. In many cases, it is good practice to retain archived certificates instead of deleting them. For example, you would need to keep an archived certificate to verify digital signatures on old documents signed using the key on the now-expired or renewed certificate.
  • If you have not already created an MMC console that contains Certificates, see Related Topics.


Request certificates

  • Request a certificate
  • Request a certificate with the same key
  • Renew a certificate with a new key
  • Renew a certificate with the same key


Request a certificate

To request a certificate

  1. Open Certificates.
  2. In the console tree, click a Certificates instance (such as Certificates – Current User or Certificates Computer Name).
  3. Do one of the following:
    • If you are in Logical Certificate Stores view mode, in the details pane, double-click Personal, and then click Certificates.
    • If you are in Certificate Purpose view mode, in the details pane, under Intended Purposes, double-click the appropriate certificate purpose mode.
  4. On the Action menu, point to All Tasks, and then click Request New Certificate to start the Certificate Request Wizard.
  5. In the Certificate Request Wizard, select the following information:
    • The type of certificate you want to request.
    • (If you have selected the Advanced check box) The cryptographic service provider (CSP) you are using.
    • (If you have selected the Advanced check box) The key length (measured in bits) of the public key associated with the certificate.
    • (If you have selected the Advanced check box) You can choose to enable strong private key protection. Enabling strong private key protection will ensure that you are prompted for a password every time the private key is used. This is useful if you want to make sure that the private key is not used without your knowledge.
    • (If you have selected the Advanced check box) If you have more than one certification authority (CA) available, the name of the certification authority that will issue the certificate.
    • A friendly name for your new certificate.
  6. After the Certificate Request Wizard has successfully finished, click OK.

Notes

  • To open Certificates, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. Then, in the console tree, click Certificates.
  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • You cannot request a certificate for a service.
  • You can use this procedure to request certificates from an enterprise certification authority only. To request certificates from a stand-alone certification authority, you need to request certificates via Web pages. A Windows certification authority has its Web pages located at http://servername/certsrv, where servername is the name of the server hosting the certification authority.
  • In order to request a Digital Signature Standard (DSS) certificate from an enterprise CA, you must select the User Signature Only certificate template in the Certificate Request Wizard.


Request a certificate with the same key

To request a certificate with the same key

  1. Open Certificates.
  2. In the console tree, under Personal, click Certificates.

    Where?

    • Certificates – Certificate holder
    • Personal
    • Certificates
  3. In the details pane, click the certificate associated with the public key you want to associate a new certificate.
  4. On the Action menu, point to All Tasks, and then click Request Certificate with Same Key to start the Certificate Request Wizard.
  5. In the Certificate Request Wizard, select the following information:
    • The type of certificate you want to request.
    • (If you have selected the Advanced check box) If you have more than one certification authority available, select the name of the certification authority that will issue the certificate.
    • A friendly name for your new certificate.
  6. After the Certificate Request Wizard has successfully finished, click OK.

Notes

  • To open Certificates, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. Then, in the console tree, click Certificates.
  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • To perform this procedure, the view mode must be organized by Logical Certificate Stores. See Related Topics.
  • You can use this procedure to request certificates from an enterprise certification authority only. To request certificates from a stand-alone certification authority, you need to request certificates via Web pages. A Windows certification authority has its Web pages located at http://servername/certsrv, where servername is the name of the server hosting the certification authority.


Renew a certificate with a new key

To renew a certificate with a new key

  1. Open Certificates.
  2. In the console tree, under Personal, click Certificates.

    Where?

    • Certificates – Certificate holder
    • Personal
    • Certificates
  3. In the details pane, click the certificate you are renewing.
  4. On the Action menu, point to All Tasks, and then click Renew Certificate with New Key to open the Certificate Renewal Wizard.
  5. In the Certificate Renewal Wizard, do one of the following:
    • Use the default values to renew the certificate.
    • (For advanced users only) Provide your own certificate renewal settings. You need to know the cryptographic service provider (CSP) and the certification authority (CA) issuing the certificate.

      You need to select the key length (measured in bits) of the public key associated with the certificate.

      You can also choose to enable strong private key protection. Enabling strong private key protection ensures that you are prompted for a password every time the private key is used. This is useful if you want to make sure that the private key is not used without your knowledge.

  6. After the Certificate Renewal Wizard has successfully finished, click OK.

Notes

  • To open Certificates, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. Then, in the console tree, click Certificates.
  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • To perform this procedure, the view mode must be organized by Logical Certificate Stores. See Related Topics.
  • Once renewed, the old certificate will be archived. For information on how to view archived certificates, see Related Topics.
  • You can use this procedure to request certificates from an enterprise certification authority only. To request certificates from a stand-alone certification authority, you need to request certificates via Web pages. A Windows certification authority has its Web pages located at http://ServerName/Certsrv, where ServerName is the name of the server that hosts the certification authority.


Renew a certificate with the same key

To renew a certificate with the same key

  1. Open Certificates.
  2. In the console tree, under Personal, click Certificates.

    Where?

    • Certificates – Certificate holder
    • Personal
    • Certificates
  3. In the details pane, click the certificate you are renewing.
  4. On the Action menu, point to All Tasks, and then click Renew Certificate with Same Key to start the Certificate Renewal Wizard.
  5. In the Certificate Renewal Wizard, do one of the following:
    • Use the default values to renew the certificate.
    • Provide your own certificate renewal settings. You need to know the certification authority issuing the certificate.
  6. After the Certificate Renewal Wizard has successfully finished, click OK.

Notes

  • To open Certificates, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. Then, in the console tree, click Certificates.
  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • To perform this procedure, the view mode must be organized by Logical Certificate Stores. See Related Topics.
  • Once renewed, the old certificate will be archived. For information on how to view archived certificates, see Related Topics.
  • You can use this procedure to request certificates from an enterprise certification authority only. To request certificates from a stand-alone certification authority, you need to request certificates via Web pages. A Windows certification authority has its Web pages located at http://ServerName/certsrv, where ServerName is the name of the server that hosts the certification authority.


Manage an individual certificate

  • View a certificate
  • Find a certificate
  • Move a certificate
  • Copy a certificate
  • Delete a certificate
  • Modify the properties of a certificate


View a certificate

To view a certificate

  1. Open Certificates.
  2. Do one of the following:
    • If you are in Logical Certificate Stores view mode, in the console tree, click Certificates.

      Where?

      • Certificates – Certificate holder
      • Logical store
      • Certificates
    • If you are in Certificate Purpose view mode, in the console tree, click Purpose.

      Where?

      • Certificates – Certificate holder
      • Purpose
  3. In the details pane, double-click the certificate.

Notes

  • To open Certificates, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. Then, in the console tree, click Certificates.
  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • To view a certificate's information, in the details pane, right-click the certificate, and then click Open.


Find a certificate

To find a certificate

  1. Open Certificates.
  2. On the console tree, click Certificates – certificate holder, where certificate holder is a Certificates instance (user, computer or service).

    Where?

    • Console Tree
    • Certificates – Certificate holder
  3. On the Action menu, click Find Certificates.
  4. Enter the following criteria to find certificates:
    • The certificate store to search
    • Text to search for
    • The certificate field to search for the specified text. You can look for text in the Issued By, Issued To, MD5 Hash, Serial Number, and SHA1 Hash fields.
  5. Click Find Now.

Note

  • To open Certificates, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. Then, in the console tree, click Certificates.
  • If you have not already created an MMC console that contains Certificates, see Related Topics.


Move a certificate

To move a certificate

  1. Open Certificates.
  2. Under the logical store where the certificate is stored, click Certificates.

    Where?

    • Certificates – Certificate holder
    • Logical store
    • Certificates
  3. In the details pane, click the certificate you are moving. (To select more than one certificate, hold down CTRL and click each certificate.)
  4. On the Action menu, click Cut.
  5. Click the logical certificate store where you want to move the certificate.

    Where?

    • Certificates – Certificate holder
    • Logical store
  6. On the Action menu, click Paste.

Notes

  • To open Certificates, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. Then, in the console tree, click Certificates.
  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • To perform this procedure, the view mode must be organized by Logical Certificate Stores. See Related Topics.
  • You can only move an object within certificate stores in Certificates. For example, you cannot move an object to a folder in Windows Explorer. See Related Topics for information about importing and exporting certificates.


Copy a certificate

To copy a certificate

  1. Open Certificates.
  2. Under the logical store where the certificate is stored, click Certificates.

    Where?

    • Certificates – Certificate holder
    • Logical store
    • Certificates
  3. In the details pane, click the certificate you are copying. (To select multiple certificates, hold down CTRL and click each certificate.)
  4. On the Action menu, click Copy.
  5. Click the logical certificate store where you want to copy the certificate.

    Where?

    • Certificates – Certificate holder
    • Logical store
  6. On the Action menu, click Paste.

Notes

  • To open Certificates, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. Then, in the console tree, click Certificates.
  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • To perform this procedure, the view mode must be organized by Logical Certificate Stores. See Related Topics.
  • You can only copy a certificate within certificate stores in Certificates. For example, you cannot copy a certificate to a folder in Windows Explorer. See Related Topics for information about importing and exporting certificates.


Delete a certificate

To delete a certificate

  1. Open Certificates.
  2. Do one of the following:
    • If you are in Logical Certificate Stores view mode, in the console tree, click Certificates.

      Where?

      • Certificates – Certificate holder
      • Logical store
      • Certificates
    • If you are in Certificate Purpose view mode, in the console tree, click Purpose.

      Where?

      • Certificates – Certificate holder
      • Purpose
  3. In the details pane, click the certificate you want to delete. (To select multiple certificates, hold down CTRL and click each certificate.)
  4. On the Action menu, click Delete.
  5. Click Yes if you are sure you want to permanently delete the certificate.

Notes

  • To open Certificates, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. Then, in the console tree, click Certificates.
  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • In some instances, there is not a Certificates folder in the console tree. In that case, navigate in the console tree until the certificate you want appears in the details pane, and then continue the procedure.
  • You might want to back up the certificate by exporting it before you delete it. For the procedure to export a certificate, see Related Topics.


Modify the properties of a certificate

To modify the properties of a certificate

  1. Open Certificates.
  2. Do one of the following:
    • If you are in Logical Certificate Stores view mode, in the console tree, under Logical Store, click Certificates.

      Where?

      • Certificates – Certificate holder
      • Logical Store
      • Certificates
    • If you are in Certificate Purpose view mode, in the console tree, click Purpose.

      Where?

      • Certificates – Certificate holder
      • Purpose
  3. In the details pane, click the certificate you want to modify.
  4. On the Action menu, click Properties.
  5. To change the friendly name of the certificate, in Friendly name, type the new name.
  6. To change the description of the certificate, in Description, type the new description.
  7. To enable all purposes for the certificate, based on the certificate type, in Certificate purposes, click Enable all purposes for this certificate.
  8. To disable all purposes for the certificate, in Certificate purposes, click Disable all purposes for this certificate.
  9. To designate specific purposes for the certificate, in Certificate purposes, click Enable only the following purposes and select the appropriate check boxes.

Notes

  • To open Certificates, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. Then, in the console tree, click Certificates.
  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • If you are logged on as a user, you can only modify the properties of certificates in the Personal store.
  • To modify the properties of a certificate, double-click the certificate, click the Details tab, and then click Edit Properties.


Import and export certificates

  • Import a certificate
  • Export a certificate
  • Export a certificate with the private key
  • View the certificates in a PKCS #7 file


Import a certificate

To import a certificate

  1. Open Certificates.
  2. In the console tree, click the logical store where you want to import the certificate.

    Where?

    • Certificates – Certificate holder
    • Logical store
  3. On the Action menu, point to All Tasks and then click Import to start the Certificate Import Wizard.
  4. Type the file name containing the certificate to be imported. (You can also click Browse and navigate to the file.)
  5. If it is a PKCS #12 file, do the following:
    • Type the password used to encrypt the private key.
    • (Optional) If you want to be able to use strong private key protection, select the Enable strong private key protection check box.
    • (Optional) If you want to back up or transport your keys at a later time, select the Mark key as exportable check box.
  6. Do one of the following:
    • If the certificate should be automatically placed in a certificate store based on the type of certificate, select Automatically select the certificate store based on the type of certificate.
    • if you want to specify where the certificate is stored, select Place all certificates in the following store, click Browse, and select the certificate store to use.

Notes

  • To open Certificates, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. Then, in the console tree, click Certificates.
  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • To perform this procedure, the view mode must be organized by Logical Certificate Stores. See Related Topics.
  • You can import a certificate into any logical store. In most cases, you will import certificates into the Personal store or the Trusted Root Certification Authorities store, depending on whether the certificate is intended for you or if it is a root CA certificate.
  • Enabling strong private key protection will ensure that you are prompted for a password every time the private key is used. This is useful if you want to make sure that the private key is not used without your knowledge.
  • To open the Certificate Import Wizard, you can open Windows Explorer. Then, in the cases of DER (.cer), Base-64 (.cer), and PKCS #7 (.p7b) files, right-click the file and click Install Certificate. In the case of a #PKCS #12 (.pfx) file, right-click the file and click Install PFX.

  • XOX

  • The file from which you import certificates will remain intact after you have completed importing the certificates. You can use Windows Explorer to delete the file if it is no longer needed.


Export a certificate

To export a certificate

  1. Open Certificates.
  2. Do one of the following:
    • If you are in Logical Certificate Stores view mode, in the console tree, click Certificates.

      Where?

      • Certificates – Certificate holder
      • Logical store
      • Certificates
    • If you are in Certificate Purpose view mode, in the console tree, click Purpose.

      Where?

      • Certificates – Certificate holder
      • Purpose
  3. In the details pane, click the certificate you want to export.
  4. On the Action menu, point to All Tasks, and then click Export.
  5. In the Certificate Export Wizard, click No, do not export the private key. (This option will appear only if the private key is marked as exportable and you have access to the private key.)
  6. Provide the following information in the Certificate Export Wizard:
    • Select the file format you want to use to store the exported certificate: a DER-encoded file, a Base64-encoded file, or a PKCS #7 file.
    • If you are exporting the certificate to a PKCS #7 file, you also have the option to include all certificates in the certification path.

Notes

  • To open Certificates, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. Then, in the console tree, click Certificates.
  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • For the procedure to export a certificate with the private key, see Related Topics.
  • After the Certificate Export Wizard is finished, the certificate will remain in the certificate store in addition to being in the new file. If you want to remove the certificate from the certificate store, you must delete it.


Export a certificate with the private key

To export a certificate with the private key

  1. Open Certificates.
  2. Do one of the following:
    • If you are in Logical Certificate Stores view mode, in the console tree, click Certificates.

      Where?

      • Certificates – Certificate holder
      • Logical store
      • Certificates
    • If you are in Certificate purpose view mode, in the console tree, click Purpose.

      Where?

      • Certificates – Certificate holder
      • Purpose
  3. In the details pane, click the certificate you want to export.
  4. On the Action menu, point to All Tasks, and then click Export.
  5. In the Certificate Export Wizard, click Yes, export the private key. (This option will appear only if the private key is marked as exportable and you have access to the private key.)
  6. Under Export File Format, do one or all of the following, and then click Next.
    • To include all certificates in the certification path, select the Include all certificates in the certification path if possible check box.
    • To enable strong protection, select the Enable strong protection (requires IE 5.0, NT 4.0 SP4 or above) check box.
    • To delete the private key if the export is successful, select the Delete the private key if the export is successful check box.
  7. In Password, type a password to encrypt the private key you are exporting. In Confirm password, type the same password again, and then click Next.
  8. In File name, type a file name and path for the PKCS #12 file that will store the exported certificate and private key, click Next, and then click Finish.

Notes

  • To open Certificates, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. Then, in the console tree, click Certificates.
  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • If a certificate was issued from a Windows 2000 Server certification authority, the private key for that certificate is only exportable if the certificate request was made via the Advanced Certificate Request certification authority Web page with the Mark keys as exportable check box selected, or if the certificate is for EFS (encrypting file system) or EFS recovery.
  • Strong protection (also known as iteration count) is enabled by default in the Certificate Export Wizard when you export a certificate with its associated private key.

    Strong protection is not compatible with older programs, so you need to clear the Enable strong protection option if you are going to use the private key with any browser older than Microsoft Internet Explorer 5.

  • After the Certificate Export Wizard is finished, the certificate will remain in the certificate store in addition to being in the newly created file. If you want to remove the certificate from the certificate store, you will need to delete it.


View the certificates in a PKCS #7 file

To view the certificates in a PKCS #7 file

  1. Open Windows Explorer.
  2. Locate the PKCS #7 file in which you want to view the certificates.
  3. In the details pane, right-click the PKCS #7 file and then click Open. Certificates loads.
  4. In the console tree, double-click the folder containing the PKCS #7 file, and then click Certificates. The certificates contained in the PKCS #7 file are displayed in the details pane.

Notes

  • XOX
  • A PKCS #7 file typically has a .p7b file name extension, but this is not always the case. As with any other data file, the creator of the file has control over the name and whether or not the .p7b extension is used.
  • For procedures to import and export a PKCS #7 file, see Related Topics.


Use Windows 2000 Certificate Services Web pages

  • Submit a user certificate request via the Web
  • Submit an advanced certificate request via the Web
  • Request a certificate using a PKCS #10 or PKCS #7 file
  • Save a certificate request to a PKCS #10 file
  • Check on a pending certificate request
  • Retrieve a certification authority certificate
  • Retrieve a certificate revocation list


Submit a user certificate request via the Web

To submit a user certificate request via the Web

  1. Open Internet Explorer.
  2. In Address, type http://servername/certsrv, where servername is the name of the Windows 2000 Web server where the certification authority (CA) you want to access is located.
  3. Click Request a certificate, and then click Next.
  4. In User certificate request, select the type of certificate you want to request, and then click Next.
  5. Under Certificate Type –Identifying Information, do one of the following:
    • If you see the message "All the necessary identifying information has already been collected. You may now submit your request," click Submit.
    • Enter your identifying information for the certificate request, and then click Submit
  6. Do one of the following:
    • If you see the Certificate Pending Web page, see Related Topics below for the procedure to check on a pending certificate.
    • If you see the Certificate Issued Web page, click Install this certificate.
  7. If you are finished using the Certificate Services Web pages, close Internet Explorer.

Note

  • XOX


Submit an advanced certificate request via the Web

To submit an advanced certificate request via the Web

  1. Open Internet Explorer.
  2. In Address, type http://servername/certsrv, where servername is the name of the Windows 2000 Web server where the certification authority you want to access is located.
  3. Click Request a certificate, and then click Next.
  4. Click Advanced request, and then click Next.
  5. Click Submit a certificate request to this CA using a form, and then click Next.
  6. Fill in any identifying information requested and any other options you require.
  7. Click Submit.
  8. Do one of the following:
    • If you see the Certificate Pending Web page, see Related Topics below for the procedure to check on a pending certificate.
    • If you see the Certificate Issued Web page, click Install this certificate.
  9. If you are finished using the Certificate Services Web pages, close Internet Explorer.

Notes

  • XOX
  • Using the Advanced Certificate Request Web page, you can set the following options for each certificate requested:
    • Certificate template (from enterprise certification authorities) or Intended purposes (from stand-alone certification authorities) indicates what applications the public key in the certificate can be used for, such as client authentication or e-mail.
    • Cryptographic service provider (CSP)
    • Key size. The length, in bits, of the public key on the certificate. In general, the longer the key, the more secure it is.
    • Hash algorithm
    • Key usage. How the private key can be used. "Exchange" means that the private key can be used to enable the exchange of sensitive information. "Signature" means that the private key can be used only to create a digital signature. "Both" means that the key can be used for both exchange and signature functions.
    • Create a new key set or use an existing key set. You can use an existing public and private key pair stored on your computer or create a new public and private key pair for a certificate. For more information about the issues of reusing a key as opposed to generating a new key, see the resources on Resources: Public key infrastructure.
    • Enable strong private key protection. When you enable strong private key protection, you are prompted for a password every time the private key needs to be used.
    • Mark keys as exportable. When you mark keys as exportable, you can save the public and private key to a PKCS #12 file. This is useful if you change computers and want to move the key pair, or if you want to remove the key pair and secure them in another location.
    • Use the local machine store. Select this option if the computer will need access to the private key associated with the certificate when other users are logged on. Select this option when requesting certificates intended to be issued to computers (such as Web servers) instead of certificates issued to people.
    • Save the request to PKCS #10 file. This is useful if the certification authority is unavailable for processing certificate requests online. For information on creating and submitting a certificate request using a PKCS #10 file, see Related Topics.


Request a certificate using a PKCS #10 or PKCS #7 file

To request a certificate using a PKCS #10 or PKCS #7 file

  1. Open Internet Explorer.
  2. In Address, type http://servername/certsrv, where servername is the name of the Windows 2000 Web server where the certification authority (CA) you want to access is located.
  3. Click Request a certificate, and then click Next. Click Advanced request, and then click Next.
  4. Click Submit a certificate request using a Base-64-encoded PKCS #10 file or a renewal request using a PKCS #7 file, and then click Next.
  5. Do one of the following:
    • Open Notepad. On the File menu, click Open. Select the PKCS #10 or PKCS #7 file and click Open. On the Edit menu, click Select all, and then, on the Edit menu, click Copy. On the Web page, click in the Saved request scroll box. On the Edit menu, click Paste to paste the contents of certificate request into the scroll box.
    • Click Browse to locate the file you want to use for the certificate request. If you get a warning about the ActiveX control, click Yes to allow it to run, then click Browse. After locating and selecting the file you want to use for the certificate request, click Read!. On the Web page, click Read! to paste the contents of the file into the scroll box. See the note about using Browse.
  6. If you are connected to an enterprise CA, choose the certificate template you want to use.
  7. Click Submit.
  8. Do one of the following:
    • If you see the Certificate Pending Web page, see Related Topics below for the procedure to check on a pending certificate.
    • If you see the Certificate Issued Web page, click Download certificate. Choose to save the file to your hard disk, and then import the certificate into your certificate store. For the procedure to import a certificate, see Related Topics.

Notes

  • XOX
  • XOX
  • In general, you use a PKCS #10 file to submit a request for a new certificate and a PKCS #7 file to submit a request to renew an existing certificate. Submitting requests with files is useful when the certificate requester is unable to submit a request online to the certification authority.
  • If you use a PKCS #7 file to submit a request to renew an existing certificate, the renewal request file must be generated by a program. This procedure will not work with a PKCS #7 file that merely contains an exported certificate.
  • You might need to make http://servername a trusted site for Internet Explorer in order to browse for a file on the computer's disk drive. To make http://servername a trusted site, in Internet Explorer, click Tools, then point to Internet Options, point to Security, point to Trusted Sites, and click Sites. Type http://servername, and click OK.
  • If you submit the request and immediately get a message asking you if you want to submit the request even though it does not contain a "BEGIN" or "END" tag, click OK.
  • For the procedure to export a certificate to create a PKCS #7 file, see Related Topics.


Save a certificate request to a PKCS #10 file

To save a certificate request to a PKCS #10 file

  1. Open Internet Explorer.
  2. In Address, type http://servername/certsrv, where servername is the name of the Windows 2000 Web server where the certification authority you want to access is located.
  3. Click Request a certificate, and then click Next.
  4. Click Advanced request, and then click Next.
  5. Click Submit a certificate request to this CA using a form, and then click Next.
  6. In Certificate Template and Key Options, select the options which you want to use for the certificate request.
  7. Under Additional Options, select the Save request to a PKCS #10 file check box.
  8. In File name, type a file name and click Save.
  9. If you are finished using the Certificate Services Web pages, close Internet Explorer.

Note

  • XOX
  • The file is saved to your computer's Desktop.


Check on a pending certificate request

To check on a pending certificate request

  1. Open Internet Explorer.
  2. In Address, type http://servername/certsrv, where servername is the name of the Windows 2000 Web server where the certification authority you want to access is located.
  3. Click Check on a pending certificate, and then click Next.
  4. If there are no pending certificate requests, you will see a message to that effect. Otherwise, select the certificate request you want to check and Next, and check the pending certificate request.
  5. If you are finished using the Certificate Services Web pages, close Internet Explorer.

Note

  • XOX
  • The available status messages are:
    • Still pending. You must wait for the administrator of the certification authority to issue the certificate. To remove the certificate request, click Remove.
    • Issued. To install the certificate, click Install this certificate.
    • Denied. Contact the administrator of the certification authority for further information.


Retrieve a certification authority certificate

To retrieve a certification authority certificate

  1. Open Internet Explorer.
  2. In Address, type http://servername/certsrv, where servername is the name of the Windows 2000 Web server where the certification authority (CA) you want to access is located.
  3. Click Retrieve the CA certificate or certificate revocation list, and then click Next.
  4. Do one of the following:
    • If you want to trust all the certificates issued by this certification authority (CA), click Install this CA certification path.
    • If the certification authority has been renewed, you will have the choice of which version of the CA certificate you want to download.
      • Under Choose file to download, click the CA certificate you want to download, and then click Download CA Certificate.
      • In File Download, click Open this file from its current location, and then click OK.
      • When the Certificate dialog box appears, click Install certificate.
      • In the Certificate Import Wizard, click Automatically select the certificate store based on the type of certificate.
  5. If you are finished using the Certificate Services Web pages, close Internet Explorer.

Notes

  • XOX
  • Choosing Install this CA certification path is useful when you want to establish trust in a subordinate CA, but you do not currently have the certificate of the root CA of the certification hierarchy in your certificate store.


Retrieve a certificate revocation list

To retrieve a certificate revocation list

  1. Open Internet Explorer.
  2. In Address, type http://servername/certsrv, where servername is the name of the Windows 2000 Web server where the certification authority (CA) you want to access is located.
  3. Click Retrieve the CA certificate or certificate revocation list (CRL), and then click Next.
  4. Click Download latest certificate revocation list.
  5. When the File Download dialog box appears, click Save this file to disk, and then click OK. Select a folder on your computer in which to store the .crl file, click Save, and then click Close.
  6. Open Windows Explorer and locate the .crl file you just saved.
  7. Right-click the .crl file and click Install CRL.
  8. When the Certificate Import Wizard opens, click Automatically select the certificate store based on the type of certificate.
  9. After completing the Certificate Import Wizard, close Internet Explorer if you are finished using the Certificate Services Web pages.

Note

  • XOX
  • XOX


Manage certificate trusts

  • Turn on automatic updating of trusted root authority certificates
  • Turn off automatic updating of trusted root authority certificates


Turn on automatic updating of trusted root authority certificates

To turn on automatic updating of trusted root authority certificates

  1. In Control Panel, open Add or Remove Programs.
  2. Click Add/Remove Windows Components.
  3. Select the Update Root Certificates check box.
  4. Click Next, and then click Finish.

Note

  • XOX


Turn off automatic updating of trusted root authority certificates

To turn off automatic updating of trusted root authority certificates

  1. In Control Panel, open Add or Remove Programs.
  2. Click Add/Remove Windows Components.
  3. Clear the Update Root Certificates check box.
  4. Click Next, and then click Finish.

Note

  • XOX


Concepts

This section provides general background information about the Certificates snap-in.

  • Certificates overview
  • Understanding certificates
  • Using certificates
  • Resources: Public key infrastructure


Certificates overview

Certificates

A public key certificate, usually just called a certificate, is a digitally-signed statement that binds the value of a public key to the identity of the person, device, or service that holds the corresponding private key. Most certificates in common use are based on the X.509v3 certificate standard. For references to extensive information about public key cryptography, see Resources: Public key infrastructure.

Certificates can be issued for a variety of functions such as Web user authentication, Web server authentication, secure e-mail (Secure/Multipurpose Internet Mail Extensions, or S/MIME), Internet Protocol security (IPSec), Transport Layer Security (TLS), and code signing. Certificates are also issued from one certification authority (CA) to another in order to establish a certification hierarchy.

The entity receives the certificate is the subject of the certificate. The issuer and signer of the certificate is a certification authority.

Typically, certificates contain the following information:

  • The subject's public key value
  • The subject's identifier information, such as the name and e-mail address
  • The validity period (the length of time that the certificate is considered valid)
  • Issuer identifier information
  • The digital signature of the issuer, which attests to the validity of the binding between the subject’s public key and the subject’s identifier information.

A certificate is valid only for the period of time specified within it; every certificate contains Valid From and Valid To dates, which set the boundaries of the validity period. Once a certificate's validity period has passed, a new certificate must be requested by the subject of the now-expired certificate.

In instances where it becomes necessary to undo the binding that is asserted in a certificate, a certificate can be revoked by the issuer. Each issuer maintains a certificate revocation list that can be used by programs when checking the validity of any given certificate.

One of the main benefits of certificates is that hosts no longer have to maintain a set of passwords for individual subjects who need to be authenticated as a prerequisite to access. Instead, the host merely establishes trust in a certificate issuer.

When a host, such as a secure Web server, designates an issuer as a trusted root authority, the host implicitly trusts the policies that the issuer has used to establish the bindings of certificates it issues. In effect, the host trusts that the issuer has verified the identity of the certificate subject. A host designates an issuer as a trusted root authority by placing the issuer's self-signed certificate, which contains the issuer's public key, into the trusted root certification authority certificate store of the host computer. Intermediate or subordinate certification authorities are trusted only if they have a valid certification path from a trusted root certification authority.

For more information about certificates, see Understanding certificates.

Certificate uses

Because certificates are generally used to establish identity and create trusts for the secure exchange of information, certification authorities (CAs) can issue certificates to people, to devices (such as computers), and to services running on computers (such as IPSec).

In some cases, computers must be able to exchange information with a high degree of confidence in the identity of the other device, service, or person involved in the transaction. In some cases, people need to exchange information with a high degree of confidence in the identity of the other person, computer, or service involved in the transaction. Applications and services that run on computers also frequently need to verify that they are accessing information from a trusted source.

In circumstances where two entities—such as devices, persons or applications or services—attempt to establish identity and trust, the fact that both entities trust the same certification authority allows the bond of identity and trust to be established between them. Once a certificate subject has presented a certificate issued by a trusted CA, the entity attempting to establish trust can proceed with an information exchange by storing the certificate subject's certificate in its own certificate store, and, where applicable, using the public key contained in the certificate to encrypt a session key so that all subsequent communications to the certificate subject are secure.

For example, when using the Internet for online banking, it is important to know that your Web browser is communicating directly and securely with your bank's Web server. Your Web browser must be able to achieve Web server authentication before a safe transaction can occur. That is, the Web server must be able to prove its identity to your Web browser before the transaction can proceed. Microsoft Internet Explorer uses Secure Sockets Layer (SSL) to encrypt messages and transmit them securely across the Internet, as do most other modern Web browsers and Web servers.

When you connect using an SSL-enabled browser to an online banking Web server that has a server certificate from a certification authority such as Verisign, the following events occur:

  • You access your bank's secured online banking login Web page using your Web browser. If you use Internet Explorer, a locked-padlock icon will appear in the lower right corner of the browser status bar to indicate that the browser is connected to a secure Web site. Other browsers depict secure connections in other ways.
  • The bank's Web server automatically sends a server certificate to your Web browser.
  • To authenticate the Web server, your Web browser checks the certificate store on your computer. If the certification authority that issued the certificate to your bank is trusted, the transaction can proceed, and the bank certificate is stored in your certificate store.
  • To encrypt all communications with the bank Web server, your Web browser creates a unique session key. Your Web browser encrypts the session key with the bank Web server certificate so that only the bank Web server can read messages sent by your browser. (Some of these messages will contain your login name and password and other sensitive information, so this level of security is necessary.)
  • The secure session is established, and sensitive information can be sent between your Web browser and the bank's Web server in a secure manner.

For more information, see Security with Certificates.

Certificates can also be used to verify the authenticity of software code that you download from the Internet, install from your company intranet, or purchase on CD-ROM and install on your computer. Unsigned software—software that does not have a valid software publisher's certificate—can pose a risk to your computer and the information you store on your computer.

When software is signed with a valid certificate from a trusted certification authority, you know that the software code has not been tampered with and can be safely installed on your computer. During software installation, you are prompted to verify that you trust the software manufacturer (for example, Microsoft Corporation). You may also be offered the option to always trust software content from that particular software manufacturer. If you choose to trust content from the manufacturer, their certificate goes into your certificate store and other software installations of their products can occur with a circumstance of predefined trust. In the circumstance of predefined trust, you can install software from the manufacturer without being prompted to indicate whether they are trusted; the certificate on your computer states that you trust the manufacturer of the software.

As with other certificates, those certificates used to verify the authenticity of software and the identity of a software publisher can have other purposes. For example, when the Certificates snap-in is set to view certificates by purpose, the Code Signing folder might contain a certificate issued to Microsoft Windows Hardware Compatibility by the Microsoft Root Authority. This single certificate has three purposes:

  • It ensures software came from the software publisher
  • It protects software from alteration after publication
  • It provides Windows hardware driver verification

Certificate use in organizations

Many organizations install their own certification authorities and issue certificates to internal devices, services, and employees to create a more secure computing environment. Large organizations may have multiple certification authorities, set up in a hierarchy that leads to a root certification authority. Thus, an employee of an organization may have a multitude of certificates in their certificate store that have been issued by a variety of internal certification authorities, all of whom share a trust connection via the certification path to the root certification authority.

When an employee logs in to the organization's network from home using virtual private network (VPN), the VPN server can present a server certificate to establish its identity. Because the corporate root authority is trusted and the corporate root certification authority issued the certificate of the VPN server, the client computer can proceed with the connection and the employee knows his computer is actually connected to his organization's VPN server.

The VPN server must also be able to authenticate the VPN client before data can be exchanged over the VPN connection. Either computer-level authentication occurs with the exchange of computer certificates or user-level authentication occurs though the use of a Point-to-Point Protocol (PPP) authentication method. For L2TP (Layer 2 Tunneling Protocol)/IPSec connections, computer certificates are required for both the client and server.

The client computer certificate may serve multiple purposes, most of which are based in authentication, allowing the client to use many organizational resources without the need for individual certificates for each resource. For example, the client certificate might allow VPN connectivity as well as access to the company store intranet site, to product servers, and to the human resources database where employee data is stored.

The VPN server certificate might also serve multiple purposes. The same certificate might have the purpose of verifying the identity of e-mail servers, Web servers, or application servers. The certification authority that issues the certificate determines the number of purposes for each certificate.

Certificates issued to persons

You can purchase a certificate from a commercial certification authority, such as Verisign, to send personal e-mail messages that are encrypted for security or digitally signed to prove authenticity.

Once you have purchased a certificate and you use it to digitally sign an e-mail message, the message recipient can verify that the message has not been altered during transit and that the message came from you—assuming, of course, that the message recipient trusts the certification authority that issued your certificate.

When you encrypt an e-mail message, nobody can read the message while it is in transit, and only the message recipient can decrypt and read the message.

Certificates and applications

Most e-mail clients allow you to automatically sign or encrypt e-mail messages or to encrypt or sign messages on an individual basis. Microsoft applications that allow e-mail messages to be digitally signed or encrypted are Microsoft Outlook 2000, Microsoft Outlook Express and Microsoft Outlook 98.

Many Windows applications use certificates. Here are some links and information about how certificates can be used with Microsoft Internet Information Services (IIS) 5.1, Microsoft Outlook 2000, Microsoft Outlook Express, Microsoft Outlook 98 and Microsoft Internet Explorer.

Internet Information Services 5.1 certificates information

IIS certificate storage is now integrated with the CryptoAPI storage. The Certificates snap-in provides a single point of entry that lets administrators store, back up, and configure server certificates.

IIS now comes with three new security task wizards that simplify most of the security tasks necessary to maintain a secure Web site. You can use the Web Server Certificate Wizard to manage Secure Sockets Layer (SSL) features in IIS and server certificates. Certificates are used in negotiating a secure link between your server and a user's browser. You can use the CTL Wizard to manage certificate trust lists (CTLs). Certificate trust lists are lists of trusted certification authorities for each Web site or virtual directory. You can use the IIS Permissions Wizard to assign Web and NTFS access permissions to Web sites, virtual directories, and files on your server.

For more information about the use of certificates in IIS, see the Microsoft Web site (http://support.microsoft.com/).

Outlook 2000 certificates information
  • "Set Up Security for Internet E-mail Messages" on the Microsoft Web site (http://support.microsoft.com/).
  • "How Can I Get a Copy of Another Person's Certificate? What You Must Do Before You Can Send Encrypted E-mail in Outlook 2000" on the Microsoft Web site (http://officeupdate.microsoft.com/).
  • "Step-by-Step Guide to Public Key Features of Outlook 2000" on the Microsoft Web site (http://www.microsoft.com/).
Outlook 98 certificates information:
  • "Secure Your Messages on the Internet" on the Microsoft Web site (http://officeupdate.microsoft.com/).
Outlook Express 5.x and above certificates information:
  • "Step-by-Step Guide to Public Key Features in Outlook Express 5.0 and Above" on the Microsoft Web site (http://www.microsoft.com/).
Internet Explorer certificates information:
  • "Step-by-Step Guide to Public Key-Based Client Authentication in Internet Explorer" on the Microsoft Web site (http://www.microsoft.com/).

Other Microsoft resources on certificates include Knowledge Base articles:

  • "Description of Symmetric and Asymmetric Encryption" on the Microsoft Web site (http://support.microsoft.com).
  • "Information About Renewing a Certification Authority Certificate in Windows 2000" on the Microsoft Web site (http://support.microsoft.com).
  • "Using a Certificate Authority for the Encrypting File Service" on the Microsoft Web site (http://support.microsoft.com).
  • "How to Restore an Encrypting File System Private Key for Encrypted Data Recovery" on the Microsoft Web site (http://support.microsoft.com).
  • "Best Practices for Encrypting File System" on the Microsoft Web site (http://support.microsoft.com).
  • "Enrolling for DSS Certificates" on the Microsoft Web site (http://support.microsoft.com).

Note

  • XOX

Certificate import and export

If you have certificates you want to use on other computers, you can export your certificates for import to other machines. For more information, see Importing and exporting certificates and Import and export certificates.

The certificate store

There are four basic sources for the certificates found in the certificate stores on your computer:

  • The certificate is included with your installation of Windows XP and came on the Windows XP CD.
  • You use an application such as an Internet browser to engage in a SSL session, during which certificates are stored on your computer after establishment of trust.
  • You explicitly choose to accept a certificate, as when you install software or receive an encrypted or digitally signed e-mail from others.
  • You request a certificate from a certification authority, such as a certificate needed to access specific organizational resources.

Over time, as you use the Internet and connect to servers that use certificates for authentication and other purposes, the certificate store on your computer will gain entries. Some certificates may have one purpose, such as server authentication or client authentication, while other certificates may serve multiple purposes. The certification authority that issues the certificate determines the purpose or purposes the certificate may serve.

Although Internet Explorer and Windows store certificates in the same certificate stores, they allow different views of the certificate stores. For more information, see To view security certificates in Internet Explorer Help and Set display options of the Certificates snap-in in Certificates Help. To better understand how the Certificates snap-in displays the certificate store, see Certificate stores.

By using the Certificates snap-in, you can view certificates by logical store or by purpose. If you view certificates by purpose, a certificate with multiple purposes will appear listed in every folder that defines a purpose for which the certificate can be used.

The Certificates snap-in

You can use the Certificates snap-in to manage certificates for users, computers, or services.

Users and administrators can use the Certificates snap-in to request new certificates from Windows 2000 enterprise certification authorities. In addition, users can find, view, import, and export certificates from within certificate stores. However, in most cases, users do not have to personally manage their certificates and their certificate stores. That can be accomplished by administrators, by policy settings, and through programs that use certificates.

Administrators are the primary users of the Certificates snap-in and, as such, they are able to perform a wide variety of certificate management tasks in their personal certificate store as well as the certificate stores for any computer or service that they have the right to administer.

See also: Requesting certificates


Understanding certificates

This section covers the following topics:

  • Certificates and certification authorities
  • Generating encryption keys and certificate requests
  • Certificate stores
  • Security with certificates


Certificates and certification authorities

When a certificate is presented to an entity as a means of identifying the certificate holder (the subject of the certificate), it is useful only if the entity receiving the certificate trusts the issuer, which is often referred to as the certification authority (CA).

When you trust a certification authority, that means you have confidence that the certification authority has the proper policies in place when evaluating certificate requests and will deny certificates to any entity that does not meet those policies. In addition, you trust that the certification authority will revoke certificates that should no longer be considered valid by publishing an up-to-date certificate revocation list. Certificate revocation lists are considered valid until they expire. So even if the CA publishes a new certificate revocation list with newly revoked certificates listed, all clients that have an old certificate revocation list will not look for, nor retrieve the new one until the old one expires or is deleted. Clients can use the CA Web pages to manually retrieve the most current certificate revocation list if necessary.

For Windows users, computers, and services, trust in a certification authority is established when you have a copy of the root certificate in the trusted root certification authorities store, as well as having a valid certification path, meaning that none of the certificates in the certification path has been revoked or has had its validity period expire. The certification path includes every certificate issued to each CA in the certification hierarchy from a subordinate CA to the root CA. For example, for a root CA, the certification path is one certificate, its own self-signed certificate. For a subordinate CA, just below the root CA in the hierarchy, its certification path is 2 certificates, its own certificate and the root CA certificate.

Certification hierarchy

If your organization is using Active Directory, then trust in your organization's certification authorities will typically be established automatically, based on decisions and settings made by the system administrator.

A related concept with which you should be familiar is certificate store inheritance. If you place a root CA certificate into the computer's trusted root certification authorities store or enterprise trust store, then any user of the computer will see that certificate in their own user trusted root certification authorities store or enterprise trust store even though the root certificate is actually in the computer's store. Essentially, users will trust any CA that their computer trusts. Certificate store inheritance does not work the other way around: certificates in the user's trusted root certification authorities store and enterprise trust store are not inherited by the computer.

If your organization is using the version of Certificate Services in Windows 2000 Server to run its certification authority, then the certification authority is one of two types: enterprise or stand-alone. The differences between the two standard types of Windows 2000 certification authorities for certificate users and requesters are summarized below.

Enterprise certification authority

An enterprise certification authority depends upon Active Directory being present.

You can use the Certificate Request Wizard (which is started from within the Certificates snap-in), as well as certification authority Web pages, to request certificates from an enterprise certification authority.

An enterprise certification authority offers different types of certificates to a requester based on the certificates it is configured to issue as well as the security permissions of the requester. An enterprise certification authority uses information available in Active Directory to help verify the requester's identity. An enterprise certification authority publishes its certificate revocation list to Active Directory as well as to a shared directory.

Stand-alone certification authority

A stand-alone certification authority is less automated for a user than an enterprise certification authority because it does not depend on the use of Active Directory.

By default, users can request certificates from a stand-alone certification authority only by using Web pages.

Stand-alone certification authorities that do not use Active Directory will generally have to request that the certificate requester provide more complete identifying information. A stand-alone certification authority makes its certificate revocation list available from a shared folder, or from Active Directory if it is available.

Notes

  • For more information about the Certificate Services policy and exit modules, which determine whether a Windows certification authority is enterprise or stand-alone, see Policy and exit modules.
  • It is possible to customize a Windows certification authority with a policy module that is different from the one shipped with Windows. In that case, the certification authority is technically neither a stand-alone nor an enterprise certification authority, but may have qualities of one or the other. For further information about customized Windows certification authorities in your organization, contact the system administrator of the certification authority.

For more information, see Requesting certificates, Using Windows Certificate Services Web pages, Certificate stores, and Resources: Public key infrastructure


Generating encryption keys and certificate requests

How you request and receive a certificate depends upon the policies and processes of the certification authority (CA) which is issuing the certificate. For example, some certification authorities have Web pages to which you can submit a request. Or, if you are in an organization that has deployed Active Directory and Certificate Services, you can use the Certificates snap-in to request a certificate if your computer is a member of a domain and you are authorized to request certificates.

In any case, when you generate a request for a new certificate, the information in that request is first passed from the requesting program to CryptoAPI . CryptoAPI will pass the proper data to a program known as a cryptographic service provider (CSP) that is installed on your computer or on a device accessible to your computer. If the CSP is software-based, it will generate a public key and a private key, often referred to as a key pair, on your computer. If the CSP is hardware-based, such as a smart card CSP, it will instruct a piece of hardware to generate the key pair.

After the keys are generated, a software CSP encrypts and then secures the private key in the registry on the computer. A smart card CSP stores the private key on a smart card and the smart card controls access to the key. The public key is sent to the certification authority, along with the certificate requester information. Once the CA verifies the certificate request according to its policies, it will use its own private key to create a digital signature in the certificate and then issue it to the requester. The certificate requester will then be presented with the certificate from the CA and the option to install it in the appropriate certificate store on the computer or hardware device.

For more information about keys and certificates, see Resources: Public key infrastructure.


Certificate stores

Windows XP stores a certificate locally on the computer or device that requested it or, in the case of a user, on the computer or device that the user used to request it. The storage location is called the certificate store. A certificate store will often have numerous certificates, possibly issued from a number of a different certification authorities.

Using the Certificates snap-in, you can display the certificate store for a user, a computer, or a service according to the purpose for which the certificates were issued or by using their logical storage categories. When you display certificates according to their storage categories, you can also choose to display the physical stores, showing the certificate storage hierarchy. (This is recommended for advanced users only.)

If you have the user rights to do so, you can import or export certificates from any of the folders in the certificate store. Additionally, if the private key associated with a certificate is marked as available for export, you can export both into a PKCS #12 file.

Windows can also publish certificates to Active Directory. Publishing a certificate in Active Directory enables all users or computers with adequate permissions to retrieve the certificate as needed.

Certificates can be displayed by purpose or by logical stores, as shown in the following table. Displaying certificates by logical stores is the Certificates default. (Note that the list of certificate purpose stores does not include all the possible purpose stores.)

Display by | Folder name | Contents
Logical Store Personal

Certificates associated with private keys to which you have access. These are the certificates that have been issued to you, or to the computer or service for which you are managing certificates.

Note to administrators: Computers in a Windows 2000 Active Directory domain can have certificates automatically placed in this store through the use of Group Policy-based autoenrollment. See Automatic certificate request settings.
Trusted Root Certification Authorities Implicitly trusted certification authorities. Includes all of the certificates in the Third-Party Root Certification Authorities store plus root certificates from your organization and Microsoft.

If you are an administrator and want to add third-party certification authority certificates to this store for all computers in a Windows 2000 Active Directory domain, you can use Group Policy to distribute trusted root certificates to your organization. See Trusted root certification authority policy.
Enterprise Trust | A container for certificate trust lists. A certificate trust list provides a mechanism for trusting self-signed root certificates from other organizations and limiting the purposes for which these certificates are trusted. For more information about Enterprise trust see Enterprise trust policy.
Intermediate Certification Authorities | Certificates issued to subordinate certification authorities.
Trusted People | Certificates issued to people or end entities that are explicitly trusted. Most often these are self-signed certificates or certificates explicitly trusted in an application such as Microsoft Outlook.
Other People | Certificates issued to people or end entities that are implicitly trusted. These certificates must be part of a trusted certification hierarchy. Most often these are cached certificates for services like Encrypting File System, where certificates are used for creating authorization for decrypting an encrypted file.
Trusted Publishers | Certificates from certification authorities that are trusted by Software Restriction policies.
Disallowed Certificates | These are certificates that you have explicitly decided not to trust using either Software Restriction policy or by clicking "Do not trust this certificate" when the decision is presented to you in mail or a Web browser.
Third-Party Root Certification Authorities | Trusted root certificates from certification authorities other than Microsoft and your organization.
Certificate Enrollment Requests | Pending or rejected certificate requests.
Active Directory User Object | Certificates associated with your user object and published in Active Directory.
Purpose | Server Authentication | Certificates that server programs use to authenticate themselves to clients.
Client Authentication | Certificates that client programs use to authenticate themselves to servers.
Code Signing | Certificates associated with key pairs used to sign active content.
Secure Email | Certificates associated with key pairs used to sign e-mail messages.
Encrypting File System | Certificates associated with key pairs that encrypt and decrypt the symmetric key used for encrypting and decrypting data by the encrypting file system.
File Recovery | Certificates associated with key pairs that encrypt and decrypt the symmetric key used for recovering encrypted data by the encrypting file system.

When you look at the contents of a certificate store in Logical Store mode, you will occasionally see what appears to be two copies of the same certificate in the store. This occurs because the same certificate is stored in separate physical stores under a logical store, such as the Registry and Enterprise physical stores under the Trusted Root Certification Authorities logical store. When the contents of the physical certificates stores are combined into one logical store view, both instances of the same certificate are displayed.

You can verify this by setting the view option to show the physical certificate stores and then noting that the certificate is stored in separate physical stores under the same logical store. You can verify that it is the same certificate by comparing the serial numbers.

For more information, see Generating encryption keys and certificate requests, Importing and exporting certificates, To display certificate stores in Purpose mode, To display certificate stores in Logical Store mode, To display archived certificates, To display certificate stores storage structure


Security with certificates

Certificates are useful for a variety of security services. Certificates can be used for:

  • Authentication. Verifying the identity of someone or something.
  • Privacy. Ensuring that information is available only to the intended audience.
  • Encryption. Disguising information so that unauthorized readers are unable to decipher it.
  • Digital signatures. Providing nonrepudiation and message integrity.


Authentication

Authentication is crucial to secure communication. Users must be able to prove their identity to those with whom they communicate and must be able to verify the identity of others. Authentication of identity on a network is complex because the communicating parties do not physically meet as they communicate. This can allow an unethical person to intercept messages or to impersonate another person or entity.

The digital certificate is a common credential that provides a means to verify identity. Certificates use cryptographic techniques to address the problem of the lack of physical contact between those communicating. Using these techniques limits the possibility of an unethical person intercepting, altering, or counterfeiting messages. These cryptographic techniques make certificates difficult to modify. Thus, it is difficult for an entity to impersonate someone else.

The data in a certificate includes the public cryptographic key from the certificate subject's public and private key pair. A message signed with its sender's private key can be verified by the message's recipient as authentic by using the sender's public key. This key can be found on a copy of the sender's certificate. Verifying a signature with a public key from a certificate proves that the signature was produced using the certificate subject's private key. If the sender has been vigilant and has kept the private key secret, the receiver can be confident in the identity of the message sender.

A few of the ways certificates are used to provide authentication are:

  • Authentication of a user to a secure Web site via the Transport Layer Security (TLS) or the Secure Sockets Layer (SSL) protocol.
  • Authentication of a server to a user via TLS.
  • Logging on to a Windows 2000 domain. (Doesn't apply to Windows XP Home Edition)

For more information about authentication and certificates, see Certificates overview and Resources: Public key infrastructure.


Privacy

Communications on a network, such as the Internet, are subject to possible monitoring by unknown and, perhaps, malicious users. Public networks are treacherous for unencrypted sensitive information because anyone can access the network and analyze the data being transmitted between two points. Even private local area networks (LANs) are vulnerable to determined efforts by intruders to acquire physical access to the network. Consequently, if sensitive information is transmitted between computing devices on any type of network, users will almost certainly want to use some sort of encryption to keep their data private.

Public key encryption is not used to encrypt large amounts of data. Instead, data is typically protected with secret key encryption and, in turn, that secret key is encrypted with the public key of the recipient of the data. The encrypted secret key will then be transmitted to the recipient along with encrypted data itself. The recipient will use the private key to decrypt the secret key. The secret key will then be used to decrypt the message itself.

Certificates enable privacy of transmitted data using a number of different methods. Some of the commonly used privacy-enabling protocols that use certificates are:

  • Secure Multipurpose Internet Mail Extensions (S/MIME)
  • Transport Layer Security (TLS)
  • Internet Protocol security (IPSec). For more information, see Introducing IPSec.

For more information about privacy and certificates, see Resources: Public key infrastructure.


Encryption

Encryption can be thought of as locking something valuable into a strong box with a key. Conversely, decryption can be compared to opening the box and retrieving the valuable item. On computers, sensitive data in the form of e-mail messages, files on a disk, and files being transmitted across the network can be encrypted using a key. Encrypted data and the key used to encrypt data are both unintelligible.

Typically, public key encryption is not used to encrypt large amounts of data. However, public key cryptography does offer an efficient method to send someone the secret key that is used when a symmetric encryption operation is performed on a large amount of data.

As an example, suppose Bob wants to send Alice a large number of encrypted files. For performance reasons, he will use a symmetric encryption key algorithm, such as Data Encryption Standard (DES), to encrypt the data. To send the encrypted data and the DES secret key needed to decrypt the data securely, Bob will encrypt the secret key with Alice's public key obtained from her certificate. Because her public key was used to encrypt the secret key, Alice, using her private key, will be the only one able to decrypt the DES secret key and thus decrypt the DES-encrypted data.

For more information, see File encryption overview. For more information about encryption and certificates, see Resources: Public key infrastructure.


Digital signatures

A digital signature is a way to ensure the integrity and origin of data. A digital signature provides strong evidence that the data has not been altered since it was signed and it confirms the identity of the person or entity who signed the data. This enables the important security features of integrity and nonrepudiation, which are essential for secure electronic commerce transactions.

Digital signatures are typically used when data is distributed in plain text, or unencrypted form. In these cases, while the sensitivity of the message itself may not warrant encryption, there could be a compelling reason to ensure that the data is in its original form and has not been sent by an impostor because, in a distributed computing environment, plain text can conceivably be read or altered by anyone on the network with the proper access, whether authorized or not.

For more information about digital signatures and certificates, see Resources: Public key infrastructure.


Using certificates

This section covers the following topics:

  • Starting the Certificates snap-in
  • Requesting certificates
  • Renewing certificates
  • Importing and exporting certificates
  • Viewing certificate information
  • Using Windows 2000 Certificate Services Web pages
  • Automatic updating of trusted root authorities


Starting the Certificates snap-in

You use the Microsoft Management Console (MMC) Certificates snap-in to manage public key certificates.

If you are the administrator of the computer, when you add Certificates to your MMC console, you have the option of managing certificates that are issued to one of the following:

  • Yourself (the My user account option)
  • Your computer (the Computer account option)
  • Local services (the Service account option)

If you are a user, when you add Certificates to your MMC console, you can manage certificates only for your user account.

A separate instance of Certificates must be loaded for each entity for which you are managing certificates.

For more information, see To manage certificates for your user account, To manage certificates for a computer, To manage certificates for a service, and Certificates overview.


Requesting certificates

Certificate requests must be made by the user, computer, or service that has access to the private key associated with the public key that will be part of the certificate. Depending upon the public key policies established by your system administrator, machines and services can automatically request certificates without user intervention. In addition, administrators can request smart card user certificates and smart card certificates for logging on to the system on behalf of other users by using their enrollment agent certificate.

There are two primary ways to explicitly request certificates in Windows.

Request certificates using the Certificate Request Wizard

When you request certificates from a Windows enterprise certification authority, you can use the Certificate Request Wizard located in the Certificates snap-in. This wizard guides you through the following steps:

  • Selecting the certification authority to which you will submit the request.

    Only enterprise certification authorities that are available in your Windows domain will be able to issue certificates using the Certificate Request Wizard.

  • Selecting the appropriate certificate template to use for the new certificate.

    Certificate templates are predefined configurations that provide common settings for the certificate request. Certificate templates describe the purpose for which the requested certificate is to be used. The list of certificate templates that is available to you is determined by the certificate types which the certification authority is configured to issue and whether you have been granted the access rights to the certificate template by the system administrator.

  • (Optional) Using Advanced Options in the Certificate Request Wizard to select the cryptographic service provider (CSP) for the key pair associated with the certificate request.

Only Basic EFS (encrypting file system) and EFS Recovery Agent certificates have their associated private keys marked as available for export when you use the Certificate Request Wizard. If you want to request another type of certificate and have its private key available for export to a PKCS #12 file, you will need to use the Advanced request page on the Windows Certificate Services Web pages.

For instructions on opening and using the Certificate Request Wizard, see To request a certificate.

You can also use the Certificate Request Wizard to request a new certificate from an enterprise certification authority by using an existing key pair that is already associated with another certificate. See To request a certificate with the same key.

Request certificates using the Windows Certificate Services Web pages

Each certification authority that is installed on a server has Web pages that users can access to submit basic and advanced certificate requests. By default, these pages are located at http://servername/certsrv, where servername is the name of the server hosting the CA.

When you request certificates from a Windows stand-alone certification authority, you use the Certificate Services Web pages. Web pages can also be used to request certificates from Windows enterprise certification authorities if you want to set optional request features that are not available in the Certificate Request Wizard, such as marking the keys as exportable, setting key length, choosing the hash algorithm, or saving the request to a PKCS #10 file.

For more information on using Certificate Services Web pages, see Using Certificate Services Web pages.

Processing certificate requests

When you submit a certificate request to a Windows enterprise certification authority, it is immediately processed, as opposed to being set to "pending." The certificate request will either immediately fail or be granted. If it is granted, the certificate is issued, and you will be prompted to install it.

When you submit a certificate request to a Windows stand-alone certification authority, it will either be immediately processed or, by default, it will be considered pending until the administrator of the certification authority approves or rejects the request. In the case of a pending request, the certificate requester will have to use the Certificate Services Web pages to check the status of pending certificates. See To check on a pending certificate request.

For more information about certificates and certification authorities, see Certificates and certification authorities.


Renewing certificates

Every certificate has a validity period. After the end of the validity period, the certificate is no longer considered an acceptable or usable credential. The Certificates snap-in enables you to renew a certificate issued from a Windows 2000 enterprise certification authority before or after the end of its validity period by using the Certificate Renewal Wizard.

You can either renew the certificate with the same key set you used before, or you can renew a certificate with a new key set. For information about the issues of reusing a key set as opposed to generating a new key set for certificate renewal, see Resources: Public key infrastructure.

Before you renew a certificate, you will need to know:

  • The issuing certification authority.
  • (Optional) If you want a new public key and private key pair for the certificate, the cryptographic service provider (CSP) that should be used to generate the key pair.

For more information, see To renew a certificate with a new key and To renew a certificate with the same key

In addition, you can renew certificates issued from both Windows 2000 enterprise certification authorities and Windows 2000 stand-alone certification authorities with the Certificate Services Web pages by pasting in the contents of a PKCS #7 file. For more information, see To request a certificate using a PKCS #10 or PKCS #7 file.


Importing and exporting certificates

The Certificates snap-in provides administrative tools to export and import certificates, including their certification paths and private keys, if needed. You can export certificates to or import certificates from PKCS #12 files, PKCS #7 files, and binary-encoded X.509 certificate files.

Importing a certificate

You might want to import a certificate:

  • To install a certificate that was sent to you in a file by another user, computer, or certification authority.
  • To restore a damaged or lost certificate that you previously backed up.
  • To install a certificate and its associated private key from a computer that the certificate holder was previously using.

When you import a certificate, you copy the certificate from a file that uses a standard certificate storage format to a certificate store for your user account or your computer account.

Exporting a certificate

You might want to export a certificate:

  • To back up a certificate.
  • To back up a certificate and its associated private key.
  • To copy a certificate for use on another computer.
  • To remove a certificate and its private key from the certificate holder's current computer for installation on another computer.

When you export a certificate, you are copying the certificate from its certificate store to a file that uses a standard certificate storage format.

Standard certificate file formats

You can import and export certificates in the following formats:

  • Personal Information Exchange (PKCS #12)

    The Personal Information Exchange format (PFX, also called PKCS #12) enables the transfer of certificates and their corresponding private keys from one computer to another or from a computer to removable media.

    PKCS #12 (Public Key Cryptography Standard #12) is an industry format that is suitable for transport or backup and restoration of a certificate and its associated private key. This can be between products from the same vendor or different vendors.

    To use the PKCS #12 format, the cryptographic service provider (CSP) must recognize the certificate and keys as exportable. If a certificate was issued from a Windows 2000 certification authority, the private key for that certificate is only exportable if one of the following is true:

    • The certificate is for EFS (encrypting file system) or EFS recovery.
    • The certificate was requested through the Advanced Certificate Request certification authority Web page with the Mark keys as exportable check box selected.

    Because exporting a private key might expose it to unintended parties, the PKCS #12 format is the only format supported in Windows XP for exporting a certificate and its associated private key.

  • Cryptographic Message Syntax Standard (PKCS #7)

    The PKCS #7 format enables the transfer of a certificate and all the certificates in its certification path from one computer to another, or from a computer to removable media. PKCS #7 files typically use the .p7b extension and are compatible with the ITU-T X.509 standard.

    PKCS #7 allows for attributes such as countersignatures to be associated with signatures. Attributes such as signing time can be authenticated along with message content.

    For more information on PKCS #7, see the PKCS #7 page at the RSA Labs Web site.

  • DER Encoded Binary X.509

    DER (Distinguished Encoding Rules) for ASN.1, as defined in ITU-T Recommendation X.509, is a more restrictive encoding standard than the alternative BER (Basic Encoding Rules) for ASN.1, as defined in ITU-T Recommendation X.209, upon which DER is based. Both BER and DER provide a platform-independent method of encoding objects (such as certificates and messages) for transmission between devices and applications.

    During certificate encoding, most applications use DER because a portion of the certificate (the Certification Request's Certification Request Info) must be DER-encoded to be signed.

    This format might be used by certification authorities that are not on Windows 2000 servers, so it is supported for interoperability. DER certificate files use the .cer extension.

    For more information, see the document "ITU-T Recommendation X.509, Information Technology — Open Systems Interconnection — The Directory: Authentication Framework," at the International Telecommunication Union (ITU) Web site.

  • Base64 Encoded X.509

    This is an encoding method developed for use with Secure/Multipurpose Internet Mail Extensions (S/MIME) which is a popular, standard method for transferring binary attachments over the Internet. Base64 encodes files into ASCII text format, making corruption less likely as the files are sent through Internet gateways, while S/MIME provides some cryptographic security services for electronic messaging applications, including non-repudiation of origin using digital signatures, privacy and data security using encryption, authentication, and message integrity.

    The MIME (Multipurpose Internet Mail Extensions) specification (RFC 1341 and successors) defines a mechanism for encoding arbitrary binary information for transmission by electronic mail.

    Because all MIME-compliant clients can decode Base64 files, this format might be used by certification authorities that are not on Windows 2000 servers, so it is supported for interoperability. Base64 certificate files use the .cer extension.

    For more information, see "RFC 2633 S/MIME Version 3 Message Specification, 1999," at the Internet Engineering Task Force (IETF) Web site and "A Layman's Guide to a Subset of ASN.1, BER and DER," an RSA Laboratories technical note.

Choosing an export format

If you are exporting certificates for import onto a computer running Windows, PKCS #7 format is the preferred export format, primarily because this format preserves the chain of certificate authorities, or the certification path, of any certificate that includes countersignatures associated with signatures.

If you are exporting certificates for import onto a computer running another operating system, it is possible that the PKCS #7 format is supported. If it is not supported, the DER Encoded Binary format or the Base64 Encoded format are provided for interoperability.

For more information, see To import a certificate, To export a certificate, To export a certificate with the private key, and To view the certificates in a PKCS #7 file.

XOX


Viewing certificate information

Using Certificates, you can view information about the fields, extensions, and properties that define an issued certificate by double-clicking any certificate displayed in the certificate store.

To view this | See this
Overview of the certificate information | General tab
Supported uses of the certificate | General tab
Entity to which the certificate was issued | General tab
Validity period of the certificate | General tab
Path of certificate to a trusted root certification authority | Certification path tab
Root certificate | Certification path tab
Subordinate certification authorities' certificates | Certification path tab
Whether root certification authority is trusted or not | Certification path tab
Certificate status | Certification path tab

The Details dialog box provides the following information about the certificate.

Certificate field | Description
Version | The X.509 version number.
Serial number | The unique serial number that the issuing certification authority assigns to the certificate. The serial number is unique for all certificates issued by a given certification authority.
Signature algorithm | The hash algorithm that the certification authority uses to digitally sign the certificate.
Issuer | Information regarding the certification authority that issued the certificate.
Valid from | The beginning date for the period in which the certificate is valid.
Valid to | The final date for the period in which the certificate is valid.
Subject | The name of the individual or certification authority to whom the certificate is issued. If the issuing certification authority exists on a domain member server in your enterprise, this will be a distinguished name within the enterprise. Otherwise, this may be a full name and e-mail name or some other personal identifier.
Public key | The public key type and length associated with the certificate.
Thumbprint algorithm | The hash algorithm that generates a digest of data (or thumbprint) for digital signatures.
Thumbprint | The digest (or thumbprint) of the certificate data.
Friendly name | (Optional) A friendly, or common, name for the name in the Subject field.
Enhanced key usage | (Optional) The purposes for which this certificate can be used.

There are additional possible X.509v3 extensions that could be in a certificate. If they are present, they will be displayed as well.

For the procedure that shows how to see the properties of a certificate, see View a certificate.


Using Windows 2000 Certificate Services Web pages

By default, every certification authority that is hosted on a server running Windows 2000 has Web pages available for users and administrators. These are used to perform a variety of tasks related to requesting certificates. These Web pages are located at http://servername/certsrv, where servername is the name of the Windows 2000 server that hosts the certification authority. The certsrv portion of the URL should always be in lowercase letters; otherwise, users may have trouble checking and retrieving pending certificates. Users can access these Web pages using Microsoft Internet Explorer version 4.0 and greater or Netscape Navigator version 3.01 and greater.

The Web pages are the only way for users to request certificates from stand-alone certification authorities. They are optional for users who want to request certificates from enterprise certification authorities. For more information about certification authorities, see Certificates and certification authorities.

If you have been granted access permissions, you can perform the following tasks from these Web pages:

  • Request a basic certificate. For more information, see To submit a user certificate request via the Web.
  • Request a certificate with advanced options. For more information, see To submit an advanced certificate request via the Web.

    This gives you greater control over the certificate request. Some of the user-selectable options that are available in an advanced certificate request include:

    • Cryptographic service provider (CSP) options. The name of the cryptographic service provider, the key size (512, 1024, and so on), the hash algorithm (SHA/RSA, SHA/DSA, MD2, MD5) and the key spec (exchange or signature).
    • Key generation options. Create a new key set or use an existing key set, mark the keys as exportable, enable strong key protection, and use the local computer store to generate the key.
    • Additional options. Save the request to a PKCS #10 file or add any specific attributes you want to add to the certificate.

    Netscape clients cannot use the advanced option Web pages.

  • Check on a pending certificate request

    If you have submitted a certificate request to a stand-alone certification authority, you will need to check the status of the pending request to see if the certification authority has issued the certificate. If the certificate has been issued, it will be available for you to install it.

  • Retrieve the certification authority's certificate to place in your trusted root store. For more information, see To retrieve a certification authority certificate.
  • Retrieve the current certificate revocation list. For more information, see To retrieve a certificate revocation list.
  • Submit a certificate request using a PKCS #10 file or a PKCS #7 file. For more information, see To request a certificate using a PKCS #10 or PKCS #7 file.
  • (For administrators only) Request a certificate for a smart card on behalf of another user. For more information, see To set up a smart card for user logon.


Automatic updating of trusted root authorities

You typically use a certificate when you use a secure Web site or when you send and receive secure e-mail. Theoretically, anyone can issue certificates, but to have truly secure transactions, certificates must be issued by a trusted entity or organization. Microsoft has included a list—in Windows XP and other products—of companies and organizations that it considers trusted authorities.

Typically, when you are presented with a certificate issued by an authority that is not in the trusted authority list that is provided with your browser or operating system, you are asked if you want to establish trust in the certification authority (CA) which issued the certificate. Many users do not want to establish trust to an authority in this way, since they have limited resources to verify the trustworthiness and issuing policies of the CA

In Windows XP, you can use the Update Root Certificates function for this. When you install Windows XP, Update Root Certificates is turned on by default. With this feature turned on, if you are presented with a certificate issued by an untrusted root authority, your computer will contact the Windows Update Web site to see if Microsoft has added the CA to its list of trusted authorities. If it has been added to the Microsoft list of trusted authorities, its certificate will automatically be added to your trusted certificate store.

For more information, see Turn off automatic updating of trusted root authority certificates, Turn on automatic updating of trusted root authority certificates, and Certificate stores.


Resources: Public key infrastructure

The following books provide detailed information about certificates, certification authorities, public key encryption, and public key infrastructure (PKI):

  • Adams, Carlisle and Steve Lloyd, Understanding the Public-Key Infrastructure. New Riders Publishing, November 1999.
  • Austin, Thomas, PKI:A Wiley Tech Brief. John Wiley & Sons, December 2000.
  • Feghhi, Jalal and Jalil Feghhi, Secure Networking with Windows 2000 and Trust Services. Addison-Wesley Pub Co., February 2001.
  • Ford, Warwick and Michael S. Baum, Secure Electronic Commerce: Building the Infrastructure for Digital Signatures and Encryption. Prentice Hall Press, April 1997.
  • Garfinkel, Simon and Gene Spafford, Web Security & Commerce. O'Reilly & Associates, June 1997.
  • Grant, Gail L., Understanding Digital Signatures: Establishing Trust over the Internet and Other Networks. Computing McGraw-Hill, November 1997.
  • Howard, Michael, Designing Secure Web-Based Applications for Microsoft Windows 2000. Microsoft Press, August 2000.
  • Schneier, Bruce, Applied Cryptography: Protocols, Algorithms, and Source Code in C. John Wiley & Sons, December 1995.

The following resources have in depth information about planning, deploying and using a public key infrastructure with Windows Certificate Services:

  • Windows 2000 Resource Kits on the Microsoft Web site (http://www.microsoft.com/).
  • "Windows 2000 Planning and Deployment" on the Microsoft Web site (http://www.microsoft.com/).
  • Microsoft Security on the Microsoft Web site (http://www.microsoft.com).

The following resource discusses in depth how to customize Windows Certificate Services:

  • The Windows Platform Software Development Kit on the Microsoft Web site (http://www.microsoft.com).

For updated technical information, see:

  • Microsoft TechNet on the Microsoft Web site (http://www.microsoft.com).
  • Updated technical information on the Microsoft Web site.