Certificates

This topic discusses certificates and the Certificates snap-in, which enables you to manage certificates for a user, computers, or services.

  • For help with specific tasks, see How to.
  • For general background information, see Concepts.


How to...

  • Add the Certificates snap-in to the MMC console
  • Set display options of the Certificates snap-in
  • Request certificates
  • Manage an individual certificate
  • Import and export certificates
  • Use Certificate Services Web pages


Add the Certificates snap-in to the MMC console

  • Manage certificates for your user account
  • Manage certificates for a computer
  • Manage certificates for a service


Manage certificates for your user account

To manage certificates for your user account

  1. Click Start, click Run, type mmc, and then click OK.
  2. On the Console menu, click Add/Remove Snap-in, and then click Add.
  3. Under Snap-in, double-click Certificates, and then:
    • If you are logged on as an administrator, click My user account, and then click Finish.
    • If you are logged on as a user, Certificates automatically loads.
  4. Click Close.

    Certificates – Current User appears on the list of selected snap-ins for the new console.

  5. If you have no more snap-ins to add to the console, click OK.
  6. To save this console, on the Console menu, click Save.

Notes

  • To switch between managing certificates for your user account, a computer, or a service, you must have separate instances of Certificates added into the console.
  • For additional help with creating and using MMC consoles, on the Help menu, click Help Topics.

Related Topics


Manage certificates for a computer

To manage certificates for a computer

  1. Log on to the system as an administrator.
  2. Click Start, click Run, type mmc, and then click OK.
  3. On the Console menu, click Add/Remove Snap-in, and then click Add.
  4. Under Snap-in, double-click Certificates, click Computer account, and then click Next.
  5. Do one of the following:
    • To manage certificates for the local computer, click Local computer, and then click Finish.
    • To manage certificates for a remote computer, click Another computer and type the name of the computer, or click Browse to select the computer name, and then click Finish.
  6. Click Close.

    Certificates Computer Name appears on the list of selected snap-ins for the new console.

  7. If you have no more snap-ins to add to the console, click OK.
  8. To save this console, on the Console menu, click Save.

Notes

  • To manage certificates for another computer, you can either create another instance of Certificates in the console, or right-click Certificates Computer Name and click Connect to Another Computer.
  • For more information on creating and using MMC consoles, on the Help menu, click Help Topics.

Related Topics


Manage certificates for a service

To manage certificates for a service

  1. Log on to the system as an administrator.
  2. Click Start, click Run, type mmc, and then click OK.
  3. On the Console menu, click Add/Remove Snap-in, and then click Add.
  4. Under Snap-in, double-click Certificates, click Service account, and then click Next.
  5. Do one of the following:
    • To manage certificates for services on your local computer, click Local computer, and then click Next.
    • To manage certificates for a remote computer, click Another computer and type the name of the computer, or click Browse to select the computer name, and then click Next.
  6. Click the service for which you are managing certificates.
  7. Click Finish, and then click Close.

    8. Certificates – Service Service name on Computer name appears on the list of selected snap-ins for the new console.

  8. If you have no more snap-ins to add to the console, click OK.
  9. To save this console, on the Console menu, click Save.

Notes

  • To manage certificates for a service on another computer, you can either create another instance of Certificates in the console or right-click Certificates Computer Name and click Connect to Another Computer.
  • For additional help creating and using MMC consoles, click Help Topics on the Help menu.

Related Topics


Set display options of the Certificates snap-in

  • Display certificate stores in Logical Store mode
  • Display certificate stores in Purpose mode
  • Display certificate stores storage structure
  • Display archived certificates


Display certificate stores in Logical Store mode

To display certificate stores in Logical Store mode

  1. Open an MMC console that contains Certificates.
  2. Click Certificates - certificate holder, where certificate holder is a Certificates instance (user, computer or service).
  3. On the View menu, click Options.
  4. Under Organize view mode by, click Logical Certificate Stores.

Note

  • If you have not already created an MMC console that contains Certificates, see Related Topics.

Related Topics


Display certificate stores in Purpose mode

To display certificate stores in Purpose mode

  1. Open an MMC console that contains Certificates.
  2. Click Certificates - certificate holder, where certificate holder is a Certificates instance (user, computer or service).
  3. On the View menu, click Options.
  4. Under Organize view mode by, click Certificate purpose.

Note

  • If you have not already created an MMC console that contains Certificates, see Related Topics.

Related Topics


Display certificate stores storage structure

To display certificate stores storage structure

  1. Open an MMC console that contains Certificates.
  2. Click Certificates - certificate holder, where certificate holder is a Certificates instance (user, computer or service).
  3. On the View menu, click Options.
  4. Under Organize view mode by, click Logical Certificate Stores.
  5. Under Show the following, select Physical Certificate Stores.

Notes

  • Displaying the certificate stores storage structure is recommended only for advanced users and developers.
  • If you have not already created an MMC console that contains Certificates, see Related Topics.

Related Topics


Display archived certificates

To display archived certificates

  1. Open an MMC console that contains Certificates.
  2. Click Certificates - certificate holder, where certificate holder is a Certificates instance (user, computer or service).
  3. On the View menu, click Options.
  4. Under Show the following, select the Archived certificates check box.

Note

  • Archived certificates are certificates that have expired or have been renewed. In many cases, it is good practice to retain archived certificates instead of deleting them. For example, you would need to keep an archived certificate to verify digital signatures on old documents signed using the key on the now-expired or renewed certificate.
  • If you have not already created an MMC console that contains Certificates, see Related Topics.

Related Topics


Request certificates

  • Request a certificate
  • Request a certificate with the same key
  • Renew a certificate with a new key
  • Renew a certificate with the same key


Request a certificate

To request a certificate

  1. Open an MMC console that contains Certificates.
  2. In the console tree, click a Certificates instance (such as Certificates – Current User or Certificates Computer Name).
  3. Do one of the following:
    • If you are in Logical Certificate Stores view mode, click Personal.
    • If you are in Certificate Purpose view mode, click the appropriate certificate purpose mode.
  4. On the Action menu, point to All Tasks, and then click Request New Certificate to start the Certificate Request wizard.
  5. In the Certificate Request wizard, select the following information:
    • The type of certificate you want to request.
    • (Optional if you have selected Advanced Options) The cryptographic service provider (CSP) you are using.
    • (Optional - if you have selected Advanced Options) You can choose to enable strong private key protection. Enabling strong private key protection will ensure that you are prompted for a password every time the private key is used. This is useful if you want to make sure that the private key is not used without your knowledge.
    • (Optional if you have selected Advanced Options) If you have more than one certification authority (CA) available, the name of the certification authority that will issue the certificate.
    • A friendly name for your new certificate.
  6. After the Certificate Request wizard has successfully finished, click Install Certificate.

Notes

  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • You can use this procedure to request certificates from an enterprise certification authority only. To request certificates from a stand-alone certification authority, you need to request certificates via Web pages. A Windows 2000 certification authority has its Web pages located at http:\\servername\certsrv, where servername is the name of Windows 2000 server hosting the certification authority.
  • In order to request a Digital Signature Standard (DSS) certificate from an enterprise CA, you must select the User Signature Only certificate template in the Certificate Request wizard.

Related Topics


Request a certificate with the same key

To request a certificate with the same key

  1. Open an MMC console that contains Certificates.
  2. In the console tree, under Personal, click Certificates.

    Where?

    • Certificates – Certificate holder
    • Personal
    • Certificates
  3. In the details pane, click the certificate associated with the public key you want to associate a new certificate.
  4. On the Action menu, point to All Tasks, and then click Request Certificate with New Key to start the Certificate Request wizard.
  5. In the Certificate Request wizard, select the following information:
    • The type of certificate you want to request.
    • (Optional if you have selected Advanced Options) If you have more than one certification authority available, select the name of the certification authority that will issue the certificate.
    • A friendly name for your new certificate.
  6. After the Certificate Request wizard has successfully finished, click Install Certificate.

Notes

  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • To perform this procedure, the view mode must be organized by Logical Certificate Stores. See Related Topics.
  • You can use this procedure to request certificates from an enterprise certification authority only. To request certificates from a stand-alone certification authority, you need to request certificates via Web pages. A Windows 2000 certification authority has its Web pages located at http:\\servername\certsrv, where servername is the name of Windows 2000 server hosting the certification authority.

Related Topics


Renew a certificate with a new key

To renew a certificate with a new key

  1. Open an MMC console that contains Certificates.
  2. In the console tree, under Personal, click Certificates.

    Where?

    • Certificates – Certificate holder
    • Personal
    • Certificates
  3. In the details pane, click the certificate you are renewing.
  4. On the Action menu, point to All Tasks, and then click Renew Certificate with New Key to open the Certificate Renewal wizard.
  5. In the Certificate Renewal wizard, do one of the following:
    • Use the default values to renew the certificate.
    • (For advanced users only) Provide your own certificate renewal settings. You need to know the cryptographic service provider (CSP) and the certification authority (CA) issuing the certificate.

      You can also choose to enable strong private key protection. Enabling strong private key protection will ensure that you are prompted for a password every time the private key is used. This is useful if you want to make sure that the private key is not used without your knowledge.

  6. After the Certificate Renewal wizard has successfully finished, click Install Certificate.

Notes

  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • To perform this procedure, the view mode must be organized by Logical Certificate Stores. See Related Topics.
  • Once renewed, the old certificate will be archived. For information on how to view archived certificates, see Related Topics.
  • You can use this procedure to request certificates from an enterprise certification authority only. To request certificates from a stand-alone certification authority, you need to request certificates via Web pages. A Windows 2000 certification authority has its Web pages located at http:\\servername\certsrv, where servername is the name of the Windows 2000 server hosting the certification authority.
  • You can renew certificates issued to Internet Information Services (IIS) 5.0 Web servers using the Web Site Certificate wizard in Internet Services Manager instead of the Certificates snap-in. If you have IIS installed on your Windows 2000 server, for instructions on using the Web Site Certificate wizard to import the contents of a .key file, see the IIS Help topic Using the new security task wizards (http://localhost/iishelp/iis/htm/core/iikeysc.htm).

Related Topics


Renew a certificate with the same key

To renew a certificate with the same key

  1. Open an MMC console that contains Certificates.
  2. In the console tree, under Personal, click Certificates.

    Where?

    • Certificates – Certificate holder
    • Personal
    • Certificates
  3. In the details pane, click the certificate you are renewing.
  4. On the Action menu, point to All Tasks, and then click Renew Certificate with Same Key to start the Certificate Renewal wizard.
  5. In the Certificate Renewal wizard, do one of the following:
    • Use the default values to renew the certificate.
    • Provide your own certificate renewal settings. You need to know the certification authority issuing the certificate.
  6. After the Certificate Renewal wizard has successfully finished, click Install Certificate.

Notes

  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • To perform this procedure, the view mode must be organized by Logical Certificate Stores. See Related Topics.
  • Once renewed, the old certificate will be archived. For information on how to view archived certificates, see Related Topics.
  • You can use this procedure to request certificates from an enterprise certification authority only. To request certificates from a stand-alone certification authority, you need to request certificates via Web pages. A Windows 2000 certification authority has its Web pages located at http:\\servername\certsrv, where servername is the name of the Windows 2000 server hosting the certification authority.
  • You can renew certificates issued to Internet Information Services (IIS) 5.0 Web servers using the Web Site Certificate wizard in Internet Services Manager instead of the Certificates snap-in. If you have IIS installed on your Windows 2000 server, for instructions on using the Web Site Certificate wizard to import the contents of a .key file, see the IIS Help topic Using the new security task wizards (http://localhost/iishelp/iis/htm/core/iikeysc.htm).

Related Topics


Manage an individual certificate

  • View a certificate
  • Find a certificate
  • Move a certificate
  • Delete a certificate
  • Modify the properties of a certificate


View a certificate

To view a certificate

  1. Open an MMC console that contains Certificates.
  2. Do one of the following:
    • If you are in Logical Certificate Stores view mode, in the console tree, click Certificates.

      Where?

      • Certificates – Certificate holder
      • Logical store
      • Certificates
    • If you are in Certificate Purpose view mode, in the console tree, click Purpose.

      Where?

      • Certificates – Certificate holder
      • Purpose
  3. In the details pane, double-click the certificate.

Notes

  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • To view a certificate's information, right-click the certificate, and then click Open.

Related Topics


Find a certificate

To find a certificate

  1. Open an MMC console that contains Certificates.
  2. Click Certificates - certificate holder, where certificate holder is a Certificates instance (user, computer or service).
  3. On the Action menu, click Find Certificates.
  4. Enter the following criteria to find certificates:
    • The certificate store to search
    • Text to search for
    • The certificate field to search for the specified text. You can look for text in the Issued To, Issued By, Serial Number, MD5 Hash, and SHA1 Hash fields.
  5. Click Find Now.

Note

  • If you have not already created an MMC console that contains Certificates, see Related Topics.

Related Topics


Move a certificate

To move a certificate

  1. Open an MMC console that contains Certificates.
  2. Under the logical store where the certificate is stored, click Certificates.

    Where?

    • Certificates – Certificate holder
    • Logical store
    • Certificates
  3. In the details pane, click the certificate you are moving.

    To select multiple certificates, hold down CTRL and click each certificate.

  4. On the Action menu, click Cut.
  5. Under the logical certificate store where you want to move the certificate, click Certificates.

    Where?

    • Certificates – Certificate holder
    • Logical store
    • Certificates
  6. On the Action menu, click Paste.

Notes

  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • To perform this procedure, the view mode must be organized by Logical Certificate Stores. See Related Topics.
  • You can only move an object within certificate stores in Certificates. For example, you cannot move an object to a folder in Windows Explorer.

Related Topics


Delete a certificate

To delete a certificate

  1. Open an MMC console that contains Certificates.
  2. Do one of the following:
    • If you are in Logical Certificate Stores view mode, in the console tree, click Certificates.

      Where?

      • Certificates – Certificate holder
      • Logical store
      • Certificates
    • If you are in Certificate Purpose view mode, in the console tree, click Purpose.

      Where?

      • Certificates – Certificate holder
      • Purpose
  3. In the details pane, click the certificate you want to delete.

    To select multiple certificates, hold down CTRL and click each certificate.

  4. On the Action menu, click Delete. Click Yes if you are sure you want to permanently delete the certificate.

Notes

  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • You might want to back up the certificate by exporting it before you delete it. For the procedure to export a certificate, see Related Topics.

Related Topics


Modify the properties of a certificate

To modify the properties of a certificate

  1. Open an MMC console that contains Certificates.
  2. Do one of the following:
    • If you are in Logical Certificate Stores view mode, in the console tree, under Personal, click Certificates.

      Where?

      • Certificates – Certificate holder
      • Personal
      • Certificates
    • If you are in Certificate Purpose view mode, in the console tree, click Purpose.

      Where?

      • Certificates – Certificate holder
      • Purpose
  3. Click the certificate you want to modify.
  4. On the Action menu, click Properties.
  5. You can:
    • Change the friendly name of the certificate.
    • Change the description of the certificate.
    • Enable all purposes for the certificate (based on the certificate type).
    • Disable all purposes for the certificate.
    • Designate specific purposes for the certificate.

Notes

  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • To modify the properties of a certificate, first view the certificate, then open the Details dialog box and click Edit Properties.

Related Topics


Import and export certificates

  • Import a certificate
  • Export a certificate
  • Export a certificate with the private key
  • View the certificates in a PKCS #7 file


Import a certificate

To import a certificate

  1. Open an MMC console that contains Certificates.
  2. In the console tree, under Personal, click Certificates.

    Where?

    • Certificates – Certificate holder
    • Personal
    • Certificates
  3. To open the Certificate Import wizard, on the All Tasks menu, click Import.
  4. Perform the following actions:
    • Click the file containing the certificates you are importing.
    • (Optional) If it is a PKCS #12 file, type the password used to encrypt the private key. Select the appropriate check box if you want the private key to be exportable, and select whether you want to enable strong private key protection.
    • Select the appropriate check box if the certificate should be automatically placed in a certificate store based on the type of certificate, or if you should be able to specify where the certificate is stored.

Notes

  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • You can import a certificate into any logical store. In most cases, you will import certificates into the personal store or the trusted root certification authorities store, depending on whether the certificate is intended for you or if it is a root CA certificate.
  • Enabling strong private key protection will ensure that you are prompted for a password every time the private key is used. This is useful if you want to make sure that the private key is not used without your knowledge.
  • To perform this procedure, the view mode must be organized by Logical Certificate Stores. See Related Topics.
  • To open the Certificate Import wizard, right-click a file containing an exported certificate:

    In the cases of DER (.cer), Base-64 (.cer), and PKCS #7 (.p7b) files, in Windows Explorer, right-click the file and click Install Certificate.

    In the case of a #PKCS #12 (.pfx) file, in Windows Explorer, right-click the file and click Install PFX.

  • The file from which you import certificates will remain intact after you have completed importing the certificates. You can use Windows Explorer to delete the file if it is no longer needed.

  • If you are moving an Internet Information Services (IIS) Web site and its public and private keys from a server running Windows NT 4.0 to one running Windows 2000, you cannot use the Certificates snap-in to import the contents of a .key file that has been created by the IIS Web Site Certificate wizard. You can only import the keys and certificate from a .key file to a server running Windows 2000 with the Web Site Certificate wizard that is included in IIS 5.0. However, this applies only when you are moving the Web site from one computer to another. When you upgrade the Web server's operating system from Windows NT 4.0 to Windows 2000, it automatically uses the existing keys and certificate.

    If you have IIS installed on the server that is running Windows 2000, for instructions on using the Web Site Certificate wizard to import the contents of a .key file, see the IIS Help topic Using the new security task wizards (http://localhost/iishelp/iis/htm/core/iikeysc.htm).

Related Topics


Export a certificate

To export a certificate

  1. Open an MMC console that contains Certificates.
  2. Do one of the following:
    • If you are in Logical Certificate Stores view mode, in the console tree, click Certificates.

      Where?

      • Certificates – Certificate holder
      • Logical store
      • Certificates
    • If you are in Certificate Purpose view mode, in the console tree, click Purpose.

      Where?

      • Certificates – Certificate holder
      • Purpose
  3. In the details pane, click the certificate you want to export.
  4. On the Action menu, point to All Tasks, and then click Export.
  5. In the Certificate Export wizard, select No, do not export the private key. (This option will appear only if the private key is marked as exportable and you have access to the private key.)
  6. Provide the following information in the Certificate Export wizard:
    • Select the file format you want to use to store the exported certificate: a DER-encoded file, a Base-64-encoded file, or a PKCS #7 file.
    • If you are exporting the certificate to a PKCS #7 file, you also have the option to include all certificates in the certification path.

Notes

  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • For the procedure to export a certificate with the private key, see Related Topics.
  • After the Certificate Export wizard is finished, the certificate will remain in the certificate store in addition to being in the newly created file. If you want to remove the certificate from the certificate store, you will need to delete it.

Related Topics


Export a certificate with the private key

To export a certificate with the private key

  1. Open an MMC console that contains Certificates.
  2. Do one of the following:
    • If you are in Logical Certificate Stores view mode, in the console tree, click Certificates.

      Where?

      • Certificates – Certificate holder
      • Logical store
      • Certificates
    • If you are in Certificate purpose view mode, in the console tree, click Purpose.

      Where?

      • Certificates – Certificate holder
      • Purpose
  3. In the details pane, click the certificate you want to export.
  4. On the Action menu, point to All Tasks, and then click Export.
  5. In the Certificate Export wizard, select Yes, export the private key. (This option will appear only if the private key is marked as exportable and you have access to the private key.)
  6. Provide the following information:
    • Select whether to include all certificates in the certification path.
    • Select whether to enable strong protection.
    • Select whether to delete the private key if the export is successful.
    • Type a password to encrypt the private key you are exporting.
    • Type a file name and path for the PKCS #12 file that will store the exported certificate and private key.

Notes

  • If you have not already created an MMC console that contains Certificates, see Related Topics.
  • If a certificate was issued from a Windows 2000 certification authority, the private key for that certificate is only exportable if:
    • The certificate request was made via the Advanced Certificate Request certification authority Web page with the Mark keys as exportable option checked, or the certificate is for EFS (encrypting file system) or EFS recovery.
  • Strong protection (also known as iteration count) is enabled by default in the Certificate Export wizard when you export a certificate with its associated private key.

    Strong protection is not compatible with older programs, so you need to clear the Enable strong protection option if you are going to use the private key with any browser older than Microsoft Internet Explorer 5.

  • After the Certificate Export wizard is finished, the certificate will remain in the certificate store in addition to being in the newly created file. If you want to remove the certificate from the certificate store, you will need to delete it.

Related Topics


View the certificates in a#PKCS #7 file

To view the certificates in a PKCS #7 file

  1. Open Windows Explorer.
  2. Locate the PKCS #7 file in which you want to view the certificates.
  3. Right-click the PKCS #7 file, and then click Open. Certificates will load.
  4. Click Certificates-File, click filename, and then click Certificates. The certificates contained in the PKCS #7 file will be displayed in the details pane.

Notes

  • To open Windows Explorer, right-click Start, and then click Explore.
  • A PKCS #7 file typically has a .p7b file extension, but this is not always the case. As with any other data file, the creator of the file has control over the name and whether or not the .p7b extension is used.
  • For procedures to import and export a PKCS #7 file, see Related Topics.

Related Topics


Use Certificate Services Web pages

  • Submit a user certificate request via the Web
  • Submit an advanced certificate request via the Web
  • Request a certificate using a PKCS #10 or PKCS #7 file
  • Save a certificate request to a PKCS #10 file
  • Check on a pending certificate request
  • Retrieve a certification authority certificate
  • Retrieve a certificate revocation list


Submit a user certificate request via the Web

To submit a user certificate request via the Web

  1. Open Internet Explorer.
  2. In Internet Explorer, connect to http://servername/certsrv, where servername is the name of the Windows 2000 Web server where the certification authority (CA) you want to access is located.
  3. Click Request a certificate, and then click Next.
  4. On the Choose Request Type Web page, under User certificate request, select the type of certificate you want to request, and click Next.
  5. Do one of the following from the Identifying Information Web page:
    • If you see the message "All the necessary identifying information has already been collected. You may now submit your request," click Submit.
    • Enter your identifying information for the certificate request, and click Submit
  6. Do one of the following:
    • If you see the Certificate Pending Web page, see Related Topics below for the procedure to check on a pending certificate.
    • If you see the Certificate Issued Web page, click Install this certificate.
  7. If you are finished using the Certificate Services Web pages, close Internet Explorer.

Note

  • To open Internet Explorer, click Start, point to Programs, and then click Internet Explorer.

Related Topics


Submit an advanced certificate request via the Web

To submit an advanced certificate request via the Web

  1. Open Internet Explorer.
  2. In Internet Explorer, connect to http://servername/certsrv, where servername is the name of the Windows 2000 Web server where the certification authority you want to access is located.
  3. Click Request a certificate, and then click Next.
  4. Click Advanced request, and click Next.
  5. Click Submit a certificate request to this CA using a form, and then click Next.
  6. Fill in any identifying information requested and any other options you require.
  7. Click Submit.
  8. Do one of the following:
    • If you see the Certificate Pending Web page, see Related Topics below for the procedure to check on a pending certificate.
    • If you see the Certificate Issued Web page, click Install this certificate.
  9. If you are finished using the Certificate Services Web pages, close Internet Explorer.

Notes

  • To open Internet Explorer, click Start, point to Programs, and then click Internet Explorer.
  • Using the Advanced Certificate Request Web page, you can set the following options for each certificate requested:
    • Certificate template (from enterprise certification authorities) or Intended purposes (from stand-alone certification authorities) indicates what applications the public key in the certificate can be used for, such as client authentication or e-mail.
    • Cryptographic service provider (CSP)
    • Key size. The length, in bits, of the public key on the certificate. In general, the longer the key, the more secure it is.
    • Hash algorithm
    • Key usage.How the private key can be used. "Exchange" means that the private key can be used to enable the exchange of sensitive information. "Signature" means that the private key can be used only to create a digital signature. "Both" means that the key can be used for both exchange and signature functions.
    • Create a new key set or use an existing key set. You can use an existing public and private key pair stored on your computer or create a new public and private key pair for a certificate. For more information about the issues of reusing a key vs. generating a new key, see the resources on Resources: Public key infrastructure.
    • Enable strong private key protection. When you enable strong private key protection, you will be prompted for a password every time the private key needs to be used.
    • Mark keys as exportable. When you mark keys as exportable, you can save the public and private key to a PKCS #12 file. This is useful if you change computers and want to move the key pair, or if you want to remove the key pair and secure them in another location.
    • Use the local machine store. Select this option if the computer will need access to the private key associated with the certificate when other users are logged on. Select this option when requesting certificates intended to be issued to computers (such as Web servers) instead of certificates issued to people.
    • Save the request to PKCS #10 file. This is useful if the certification authority is unavailable for processing certificate requests online. For information on creating and submitting a certificate request using a PKCS #10 file, see Related Topics.

Related Topics


Request a certificate using a PKCS #10 or PKCS #7 file

To request a certificate using a PKCS #10 or PKCS #7 file

  1. Open Internet Explorer.
  2. In Internet Explorer, connect to http://servername/certsrv, where servername is the name of the Windows 2000 Web server where the certification authority (CA) you want to access is located.
  3. Click Request a certificate, and then click Next. Click Advanced request, and click Next.
  4. Click Submit a certificate request using a Base-64-encoded PKCS #10 file or a renewal request using a PKCS #7 file, and then click Next.
  5. Do one of the following:
    • In Notepad, click File, click Open, select the PKCS #10 or PKCS #7 file, click Edit, click Select all, click Edit, and click Copy. On the Web page, click in the Saved request scroll box. Click Edit and then click Paste to paste the contents of certificate request into the scroll box.
    • Click Browse to locate the file you want to use for the certificate request. If you get a warning about the ActiveX control, click Yes to allow it to run, then click the Browse button. After locating and selecting the file you want to use for the certificate request, click Open. On the Web page, click Read! to paste the contents of the file into the scroll box. See the note about using Browse.
  6. If you are connected to an enterprise CA, choose the certificate template you want to use.
  7. Click Submit.
  8. Do one of the following:
    • If you see the Certificate Pending Web page, see Related Topics below for the procedure to check on a pending certificate.
    • If you see the Certificate Issued Web page, click Download certificate. Choose to save the file to your hard disk, and then import the certificate into your certificate store. For the procedure to import a certificate, see Related Topics.

Notes

  • To open Internet Explorer, click Start, point to Programs, and then click Internet Explorer.
  • To open Notepad, click Start, point to Programs, point to Accessories, and click Notepad.
  • In general, you use a PKCS #10 file to submit a request for a new certificate and a PKCS #7 file to submit a request to renew an existing certificate. Submitting requests with files is useful when the certificate requester is unable to submit a request online to the certification authority.
  • You might need to make http://servername a trusted site for Internet Explorer in order to browse for a file on the computer's disk drive. To make http://servername a trusted site, in Internet Explorer, click Tools, then point to Internet Options, point to Security, point to Trusted Sites, and click Sites. Type http://servername, and click OK.
  • If you submit the request and immediately get a message asking you if you want to submit the request even though it does not contain a "BEGIN" or "END" tag, click OK.
  • For the procedure to export a certificate to create a PKCS #7 file, see Related Topics.

Related Topics


Save a certificate request to a PKCS #10 file

To save a certificate request to a PKCS #10 file

  1. Open Internet Explorer.
  2. In Internet Explorer, open http://servername/certsrv, where servername is the name of the Windows 2000 Web server where the certification authority you want to access is located.
  3. Click Request a certificate, and then click Next.
  4. Click Advanced request, and click Next.
  5. Click Submit a certificate request to this CA using a form, and then click Next.
  6. Enter any identifying information requested and any other options you require.
  7. Under Additional Options, select Save request to a PKCS #10 file.
  8. In the File name field, type a file name.
  9. Click Submit. The file is saved to your computer's Desktop.
  10. If you are finished using the Certificate Services Web pages, close Internet Explorer.

Note

  • To open Internet Explorer, click Start, point to Programs, and then click Internet Explorer.

Related Topics


Check on a pending certificate request

To check on a pending certificate request

  1. Open Internet Explorer.
  2. In Internet Explorer, open http://servername/certsrv, where servername is the name of the Windows 2000 Web server where the certification authority you want to access is located.
  3. Click Check on a pending certificate, and then click Next.
  4. If there are no pending certificate requests, you will see a message to that effect. Otherwise, select the certificate request you want to check, and click Next
  5. Check the pending certificate requests:
    • Still pending. You must wait for the administrator of the certification authority to issue the certificate. To remove the certificate request, click Remove.
    • Issued. To install the certificate, click Install this certificate.
    • Denied. Contact the administrator of the certification authority for further information.
  6. If you are finished using the Certificate Services Web pages, close Internet Explorer.

Note

  • To open Internet Explorer, click Start, point to Programs, and then click Internet Explorer.
Related Topics


Retrieve a certification authority certificate

To retrieve a certification authority certificate

  1. Open Internet Explorer.
  2. In Internet Explorer, connect to http://servername/certsrv, where servername is the name of the Windows 2000 Web server where the certification authority (CA) you want to access is located.
  3. Click Retrieve the CA certificate or certificate revocation list, and then click Next.
  4. Do one of the following:
    • If you want to trust all the certificates issued by this certification authority (CA), click Install this CA certification path.
    • If the certification authority has been renewed, you will have the choice of which version of the CA certificate you want to download.
      • Under Choose file to download, click the CA certificate you want to download, and then click Download CA Certificate.
      • In File Download, click Open this file from its current location, and then click OK.
      • When the Certificate dialog box appears, click Install this certificate.
      • In the Certificate Import wizard, click Automatically select the certificate store based on the type of certificate.
  5. If you are finished using the Certificate Services Web pages, close Internet Explorer.

Notes

  • To open Internet Explorer, click Start, point to Programs, and then click Internet Explorer.
  • Choosing Install this CA certification path is useful when you want to establish trust in a subordinate CA, but you do not currently have the certificate of the root CA of the certification hierarchy in your certificate store.
Related Topics


Retrieve a certificate revocation list

To retrieve a certificate revocation list

  1. Open Internet Explorer.
  2. In Internet Explorer, connect to http://servername/certsrv, where servername is the name of the Windows 2000 Web server where the certification authority (CA) you want to access is located.
  3. Click Retrieve the CA certificate or certificate revocation list (CRL), and then click Next.
  4. Click Download last certificate revocation list.
  5. When the File Download dialog box appears, click Save this file to disk, and then click OK. Select a folder on your computer in which to store the .crl file, and click Save.
  6. Open Windows Explorer and locate the .crl file you just saved.
  7. Right-click the .crl file and click Install CRL.
  8. When the Certificate Import wizard opens, click Automatically select the certificate store based on the type of certificate.
  9. After completing the Certificate Import wizard, close Internet Explorer if you are finished using the Certificate Services Web pages.

Note

  • To open Internet Explorer, click Start, point to Programs, and then click Internet Explorer.
Related Topics


Concepts

This section provides general background information about the Certificates snap-in.

  • Certificates overview
  • Understanding certificates
  • Using certificates
  • Resources: Public key infrastructure


Certificates overview

Certificates

A public key certificate, usually just referred to as a certificate, is a digitally signed statement that binds the value of a public key to the identity of the person, device, or service that holds the corresponding private key. For references to extensive information about public key cryptography, see Resources: Public key infrastructure.

Certificates can be issued for a variety of functions such as Web user authentication, Web server authentication, secure e-mail (S/MIME), IP Security, Transaction Layer Security (TLS), and code signing. If the Windows 2000 enterprise certification authority is used in an organization, certificates can be used to log on to Windows 2000 domains. Certificates are also issued from one certification authority to another in order to establish a certification hierarchy.

The entity being issued the certificate is referred to as the subject of the certificate. The issuer and signer of the certificate is known as a certification authority. Most certificates in use today are based on the X.509 standard, and this is the fundamental technology used in the Windows 2000 public key infrastructure (PKI).

Typically, certificates contain the following information:

  • Subject public key value
  • Subject identifier information (such as the name and e-mail address)
  • Validity period (the length of time that the certificate is considered valid)
  • Issuer identifier information
  • The digital signature of the issuer, which attests to the validity of the binding between the subject public key and the subject identifier information.

A certificate is valid only for the period of time specified within it; every certificate contains Valid From and Valid To dates, which are the boundaries of the validity period. Once a certificate's validity period has passed, a new certificate must be requested by the subject of the now-expired certificate.

In instances where it becomes necessary to undo the binding asserted in a certificate, a certificate can be revoked by the issuer. Each issuer maintains a certificate revocation list that can be used by programs when checking the validity of any given certificate.

One of the main benefits of certificates is that hosts no longer have to maintain a set of passwords for individual subjects who need to be authenticated as a prerequisite to access. Instead, the host merely establishes trust in a certificate issuer.

When a host, such as a secure Web server, designates an issuer as a trusted root authority, the host implicitly trusts the policies that the issuer has used to establish the bindings of certificates it issues. In effect, the host trusts that the issuer has verified the identity of the certificate subject. A host designates an issuer as a trusted root authority by placing the issuer's self-signed certificate containing the issuer's public key into the trusted root certification authority certificate store of the host computer. Intermediate or subordinate certification authorities are trusted only if they have a valid certification path from a trusted root certification authority.

For more information about certificates, see Understanding certificates.

The Certificates snap-in

You can use the Certificates snap-in to manage certificates for users, computers, or services.

Users and administrators can use the Certificates snap-in to request new certificates from Windows 2000 enterprise certification authorities. In addition, users can find, view, import, and export certificates from within certificate stores. However, in most cases, users do not have to personally manage their certificates and their certificate stores. That can be accomplished by administrators, by policy settings, and through programs that use certificates.

Administrators are the primary users of the Certificates snap-in, and as such they are able to perform a wide variety of certificate management tasks in their personal certificate store as well as the certificate stores for any computer or service that they have the right to administer.


Understanding certificates

This section covers the following topics:

  • Certificates and certification authorities
  • Generating encryption keys and certificate requests
  • Certificate stores
  • Security with certificates


Certificates and certification authorities

When a certificate is presented to an entity as a means of identifying the certificate holder (the subject of the certificate), it is useful only if the entity being presented the certificate trusts the issuer, which is often referred to as the certification authority.

When you trust a certification authority, that means you have confidence that the certification authority has the proper policies in place when evaluating certificate requests and will deny certificates to any entity that does not meet those policies. In addition, you trust that the certification authority will revoke certificates that should no longer be considered valid by publishing an up-to-date certificate revocation list. Certificate revocation lists are considered valid until they expire. So even if the CA publishes a new certificate revocation list with newly revoked certificates listed, all clients that have an old certificate revocation list will not look for, nor retrieve the new one until the old one expires or is deleted. Clients can use the CA Web pages to manually retrieve the most current certificate revocation list if necessary.

For Windows 2000 users, computers, and services, trust in a certification authority is established when you have a copy of the root certificate in the trusted root certification authorities store, as well as having a valid certification path, meaning that none of the certificates in the certification path has been revoked or has had its validity period expire. The certification path includes every certificate issued to each CA in the certification hierarchy from a subordinate CA to the root CA. For example, for a root CA, the certification path is one certificate, its own self-signed certificate. For a subordinate CA, just below the root CA in the hierarchy, it's certification path is 2 certificates, its own certificate and the root CA certificate.

If your organization is using Active Directory, then trust in your organization's certification authorities will typically be established automatically, based on decisions and settings made by the system administrator.

A related concept with which you should be familiar is certificate store inheritence. If you place a root CA certificate into the computer's trusted root certification authorities store or enterprise trust store, then any user of the computer will see that certificate in their own user trusted root certification authorities store or enterprise trust store even though the root certificate is actually in the computer's store. Essentially, users will trust any CA that their computer trusts. Certificate store inheritance does not work the other way around: certificates in the user's trusted root certification authorities store and enterprise trust store are not inherited by the computer.

If your organization is using the version of Certificate Services in Windows 2000 Server to run its certification authority, then the certification authority is one of two types: enterprise or stand-alone. The differences between the two standard types of Windows 2000 certification authorities for certificate users and requesters are summarized below.

Enterprise certification authority

An enterprise certification authority depends upon Active Directory being present.

You can use the Certificate Request wizard (which is started from within the Certificates snap-in), as well as certification authority Web pages, to request certificates from an enterprise certification authority.

An enterprise certification authority offers different types of certificates to a requester based on the certificates it is configured to issue as well as the security permissions of the requester. An enterprise certification authority uses information available in Active Directory to help verify the requester's identity. An enterprise certification authority publishes its certificate revocation list to Active Directory as well as to a shared directory.

Stand-alone certification authority

A stand-alone certification authority is less automated for a user than an enterprise certification authority because it does not depend on the use of Active Directory.

By default, users can request certificates from a stand-alone certification authority only by using Web pages.

Stand-alone certification authorities that do not use Active Directory will generally have to request that the certificate requester provide more complete identifying information. A stand-alone certification authority makes its certificate revocation list available from a shared folder, or from Active Directory if it is available.

Notes

  • For more information about the Certificate Services policy and exit modules, which determine whether a Windows 2000 certification authority is enterprise or stand-alone, see Policy and exit modules.
  • It is possible to customize a Windows 2000 certification authority with a policy module that is different from the one shipped with Windows 2000. In that case, the certification authority is technically neither a stand-alone nor an enterprise certification authority, but may have qualities of one or the other. For further information about customized Windows 2000 certification authorities in your organization, contact the system administrator of the certification authority.
See also:
  • Certification authorities
  • Certificate Services overview
  • Requesting certificates
  • Using Windows 2000 Certificate Services Web pages
  • Certificate stores
  • Resources: Public key infrastructure


Generating encryption keys and certificate requests

When you generate a request for a new certificate, the information in that request is first passed from the requesting program to the Microsoft Cryptographic Application Program Interface, also known as CryptoAPI . CryptoAPI will pass the proper data to a program known as acryptographic service provider (CSP) installed on your computer or on a device accessible to your computer. If the CSP is software-based, it will generate a public key and a private key, often referred to as a key pair, on your computer. If the CSP is hardware-based, such as a smart card CSP, it will instruct a piece of hardware to generate the key pair.

After the keys are generated, a software CSP encrypts and then secures the private key in the registry on the computer. A smart card CSP stores the private key on a smart card and the smart card controls access to the key. The public key is sent to thecertification authority (CA) , along with the certificate requester information. Once the CA verifies the certificate request according to its policies, it will use its own private key to create a digital signature in the certificate and then issue it to the requester. The certificate requester will then be presented with the certificate from the CA and the option to install it in the appropriate certificate store on the computer or hardware device.

For more information about keys and certificates, see Resources: Public key infrastructure.

See also:

Requesting certificates


Certificate stores

Windows 2000 stores a certificate locally on the computer or device that requested it or, in the case of a user, on the computer or device that the user used to request it. The storage location is called the certificate store. A certificate store will often have numerous certificates, possibly issued from a number of a different certification authorities.

Using the Certificates snap-in, you can display the certificate store for a user, a computer, or a service according to the purpose for which the certificates were issued or by using their logical storage categories. When you display certificates according to their storage categories, you can also choose to display the physical stores, showing the certificate storage hierarchy. (This is recommended for advanced users only.)

If you have the user rights to do so, you can import or export certificates from any of the folders in the certificate store. Additionally, if the private key associated with a certificate is marked as available for export, you can export both into a PKCS #12 file.

Windows can also publish certificates to Active Directory. Publishing a certificate in Active Directory enables all users or computers with adequate permissions to retrieve the certificate as needed.

Certificates can be displayed by purpose or by logical stores, as shown in the following table. Displaying certificates by logical stores is the Certificates default. (Note that the list of certificate purpose stores does not include all the possible purpose stores.)

Display by | Folder name | Contents
Logical Store | Personal | Certificates associated with private keys to which you have access.
 | Trusted Root Certification Authorities | Implicitly trusted certification authorities.
 | Enterprise Trust | A container for certificate trust lists. A certificate trust list provides a mechanism for trusting self-signed root certificates from other organizations and limiting the purposes for which these certificates are trusted.
 | Intermediate Certification Authorities | Certificates issued to other people and other certification authorities.
 | Active Directory User Object | Certificates associated with your user object and published in Active Directory.
 | REQUEST | Pending or rejected certificate requests.
Purpose | Server Authentication | Certificates that server programs use to authenticate themselves to clients.
 | Client Authentication | Certificates that client programs use to authenticate themselves to servers.
 | Code Signing | Certificates associated with key pairs used to sign active content.
 | Secure Email | Certificates associated with key pairs used to sign e-mail messages.
 | Encrypting File System | Certificates associated with key pairs that encrypt and decrypt the symmetric key used for encrypting and decrypting data by the encrypting file system.
 | File Recovery | Certificates associated with key pairs that encrypt and decrypt the symmetric key used for recovering encrypted data by the encrypting file system.
See also:
  • Generating encryption keys and certificate requests
  • Importing and exporting certificates
  • To display certificate stores in Purpose mode
  • To display certificate stores in Logical Store mode
  • To display archived certificates
  • To display certificate stores storage structure


Security with certificates

Certificates are useful for a variety of security services. Certificates can be used for:

  • Authentication. Verifying the identity of someone or something.
  • Privacy. Ensuring that information is available only to the intended audience.
  • Encryption. Disguising information so that unauthorized readers are unable to decipher it.
  • Digital signatures. Providing nonrepudiation and message integrity.


Authentication

Authentication is crucial to secure communication. Users must be able to prove their identity to those with whom they communicate and must be able to verify the identity of others. Authentication of identity on a network is complex because the communicating parties do not physically meet as they communicate. This can allow an unethical person to intercept messages or to impersonate another person or entity.

The digital certificate is a common credential that provides a means to verify identity. Certificates use cryptographic techniques to address the problem of the lack of physical contact between those communicating. Using these techniques limits the possibility of an unethical person intercepting, altering, or counterfeiting messages. These cryptographic techniques make certificates difficult to modify. Thus, it is difficult for an entity to impersonate someone else.

The data in a certificate includes the public cryptographic key from the certificate subject's public and private key pair. A message signed with its sender's private key can be verified by the message's recipient as authentic by using the sender's public key. This key can be found on a copy of the sender's certificate. Verifying a signature with a public key from a certificate proves that the signature was produced using the certificate subject's private key. If the sender has been vigilant and has kept the private key secret, the receiver can be confident in the identity of the message sender.

A few of the ways certificates are used to provide authentication are:

  • Authentication of a user to a secure Web site via the Transport Layer Security (TLS) or the Secure Sockets Layer (SSL) Protocol.
  • Authentication of a server to a user via TLS.
  • Logging on to a Windows 2000 domain.

For more information about authentication and certificates, see Resources: Public key infrastructure.


Privacy

Communications on a network, such as the Internet, are subject to possible monitoring by unknown and, perhaps, malicious users. Public networks are treacherous for unencrypted sensitive information because anyone can access the network and analyze the data being transmitted between two points. Even private local area networks (LANs) are vulnerable to determined efforts by intruders to acquire physical access to the network. Consequently, if sensitive information is transmitted between computing devices on any type of network, users will almost certainly want to use some sort of encryption to keep their data private.

Public key encryption is not used to encrypt large amounts of data. Instead, data is typically protected with secret key encryption and, in turn, that secret key is encrypted with the public key of the recipient of the data. The encrypted secret key will then be transmitted to the recipient along with encrypted data itself. The recipient will use the private key to decrypt the secret key. The secret key will then be used to decrypt the message itself.

Certificates enable privacy of transmitted data using a number of different methods. Some of the commonly used privacy-enabling protocols that use certificates are:

  • Secure Multipurpose Internet Mail Extensions (S/MIME)
  • Transport Layer Security (TLS)
  • IP Security (IPSec). See IP Security: What it is

For more information about privacy and certificates, see Resources: Public key infrastructure.


Encryption

Encryption can be thought of as locking something valuable into a strong box with a key. Conversely, decryption can be compared to opening the box and retrieving the valuable item. On computers, sensitive data in the form of e-mail messages, files on a disk, and files being transmitted across the network can be encrypted using a key. Encrypted data and the key used to encrypt data are both unintelligible.

Typically, public key encryption is not used to encrypt large amounts of data. However, public key cryptography does offer an efficient method to send someone the secret key that was used when a symmetric encryption operation was performed on a large amount of data.

As an example, suppose Bob wants to send Alice a large number of encrypted files. For performance reasons, he will use a symmetric encryption key algorithm, such as Data Encryption Standard (DES), to encrypt the data. To send the encrypted data and the DES secret key needed to decrypt the data securely, Bob will encrypt the secret key with Alice's public key obtained from her certificate. Because her public key was used to encrypt the secret key, Alice, using her private key, will be the only one able to decrypt the DES secret key and thus decrypt the DES-encrypted data.

See also:

File encryption overview

For more information about encryption and certificates, see Resources: Public key infrastructure.


Digital signatures

A digital signature is a way to ensure the integrity and origin of data. A digital signature provides strong evidence that the data has not been altered since it was signed and it confirms the identity of the person or entity who signed the data. This enables the important security features of integrity and nonrepudiation, which are essential for secure electronic commerce transactions.

Digital signatures are typically used when data is distributed in clear text, or unencrypted form. In these cases, while the sensitivity of the message itself may not warrant encryption, there could be a compelling reason to ensure that the data is in its original form and has not been sent by an impostor because, in a distributed computing environment, clear text can conceivably be read or altered by anyone on the network with the proper access, whether authorized or not.

For more information about digital signatures and certificates, see Resources: Public key infrastructure.


Using certificates

This section covers the following topics:

  • Starting the Certificates snap-in
  • Requesting certificates
  • Renewing certificates
  • Importing and exporting certificates
  • Viewing certificate information
  • Using Windows 2000 Certificate Services Web pages
  • Common tasks with certificates


Starting the Certificates snap-in

You use the Microsoft Management Console (MMC) Certificates snap-in to manage public key certificates.

If you are an administrator of a computer, or a domain administrator, when you add Certificates to your MMC console you have the option of managing certificates that are issued to one of the following:

  • Yourself (My user account option)
  • Your computer (Computer account option)
  • Local services (Service account option)

If you are a user, when you add Certificates to your MMC console, you can manage certificates only for your user account.

A separate instance of Certificates must be loaded for each entity for which you are managing certificates.

See also:

  • To manage certificates for your user account
  • To manage certificates for a computer
  • To manage certificates for a service


Requesting certificates

Certificate requests must be made by the user, computer, or service that has access to the private key associated with the public key that will be part of the certificate. Depending upon the public key policies established by your system administrator, machines and services can automatically request certificates without user intervention. In addition, administrators can request smart card user certificates and smart card certificates for logging on to the system on behalf of other users by using their enrollment agent certificate.

There are two primary ways to explicitly request certificates in Windows 2000.

Request certificates using the Certificate Request wizard

When you request certificates from a Windows 2000 enterprise certification authority, you can use the Certificate Request wizard located in the Certificates snap-in. This wizard guides you through the following steps:

  • Selecting the certification authority to which you will submit the request.

    Only enterprise certification authorities that are available in your Windows domain will be able to issue certificates using the Certificate Request wizard.

  • Selecting the appropriate certificate template to use for the new certificate.

    Certificate templates are predefined configurations that provide common settings for the certificate request. Certificate templates describe the purpose for which the requested certificate is to be used. The list of certificate templates that is available to you is determined by the certificate types which the certification authority is configured to issue and whether you have been granted the access rights to the certificate template by the system administrator.

  • (Optional) Using Advanced Options in the Certificate Request wizard to select the cryptographic service provider (CSP) for the key pair associated with the certificate request.

Only Basic EFS (encrypting file system) and EFS Recovery Agent certificates have their associated private keys marked as available for export when you use the Certificate Request wizard. If you want to request another type of certificate and have its private key available for export to a PKCS #12 file, you will need to use the Advanced request page on the Windows 2000 Certificate Services Web pages.

For instructions on opening and using the Certificate Request wizard, see To request a certificate.

You can also use the Certificate Request wizard to request a new certificate from an enterprise certification authority by using an existing key pair that is already associated with another certificate. See To request a certificate with the same key.

Request certificates using the Windows 2000 Certificate Services Web pages

Each certification authority that is installed on a Windows 2000 server has Web pages that users can access to submit basic and advanced certificate requests. By default, these pages are located at http://servername/certsrv, where servername is the name of the Windows 2000 server hosting the CA.

When you request certificates from a Windows 2000 stand-alone certification authority, you use the Certificate Services Web pages. Web pages can also be used to request certificates from Windows 2000 enterprise certification authorities if you want to set optional request features that are not available in the Certificate Request wizard, such as marking the keys as exportable, setting key length, choosing the hash algorithm, or saving the request to a PKCS #10 file.

For more information on using Certificate Services Web pages, see Using Windows 2000 Certificate Services Web pages.

Processing certificate requests

When you submit a certificate request to a Windows 2000 enterprise certification authority, it is immediately processed, as opposed to being set to "pending." The certificate request will either immediately fail or be granted. If it is granted, the certificate is issued, and you will be prompted to install it.

When you submit a certificate request to a Windows 2000 stand-alone certification authority, it will either be immediately processed or, by default, it will be considered pending until the administrator of the certification authority approves or rejects the request. In the case of a pending request, the certificate requester will have to use the Certificate Services Web pages to check the status of pending certificates. See To check on a pending certificate request.

For more information about certificates and certification authorities, see Certificates and certification authorities.


Renewing certificates

Every certificate has a validity period. After the end of the validity period, the certificate is no longer considered an acceptable or usable credential. The Certificates snap-in enables you to renew a certificate issued from a Windows 2000 enterprise certification authority before or after the end of its validity period by using the Certificate Renewal wizard.

You can either renew the certificate with the same key set you used before, or you can renew a certificate with a new key set. For information about the issues of reusing a key set vs. generating a new key set for certificate renewal, see Resources: Public key infrastructure.

Before you renew a certificate, you will need to know:

  • The issuing certification authority.
  • (Optional) If you want a new public key and private key pair for the certificate, the cryptographic service provider (CSP) that should be used to generate the key pair.

See also:

  • To renew a certificate with a new key
  • To renew a certificate with the same key

In addition, you can renew certificates issued from both Windows 2000 enterprise certification authorities and Windows 2000 stand-alone certification authorities with the Certificate Services Web pages by pasting in the contents of a PKCS #7 file. For more information, see To request a certificate using a PKCS #10 or PKCS #7 file.


Importing and exporting certificates

The Certificates snap-in provides administrative tools to export and import certificates, including their certification paths and private keys, if needed. You can export certificates to or import certificates from PKCS #12 files, PKCS #7 files, and binary-encoded X.509 certificate files.

Importing a certificate

You might want to import a certificate:

  • To install a certificate that was sent to you in a file by another user, computer, or certification authority.
  • To restore a damaged or lost certificate that you previously backed up.
  • To install a certificate and its associated private key from a computer that the certificate holder was previously using.

When you import a certificate, you copy the certificate from a file that uses a standard certificate storage format to a certificate store for your user account or your computer account.

Exporting a certificate

You might want to export a certificate:

  • To back up a certificate.
  • To back up a certificate and its associated private key.
  • To copy a certificate for use on another computer.
  • To remove a certificate and its private key from the certificate holder's current computer for installation on another computer.

When you export a certificate, you are copying the certificate from its certificate store to a file that uses a standard certificate storage format.

Standard certificate file formats

You can import and export certificates in the following formats:

  • Personal Information Exchange (PKCS #12)

    The Personal Information Exchange format (PFX, also called PKCS #12) enables the transfer of certificates and their corresponding private keys from one computer to another or from a computer to removable media.

    PKCS #12 is an industry format suitable for transport or backup and restoration of a certificate and its associated private key. This can be between products from the same vendor or different vendors.

    To use the PKCS #12 format, the cryptographic service provider (CSP) must recognize the certificate and keys as exportable. If a certificate was issued from a Windows 2000 certification authority, the private key for that certificate is only exportable if one of the following is true:

    • The certificate is for EFS (encrypting file system) or EFS recovery.
    • The certificate was requested through the Advanced Certificate Request certification authority Web page with the Mark keys as exportable check box selected.

    Because exporting a private key might expose it to unintended parties, the PKCS #12 format is the only format supported in Windows 2000 for exporting a certificate and its associated private key.

  • Cryptographic Message Syntax Standard (PKCS #7)

    The PKCS #7 format enables the transfer of a certificate and all the certificates in its certification path from one computer to another, or from a computer to removable media. PKCS #7 files typically use the .p7b extension.

  • DER Encoded Binary X.509

    This format might be used by certification authorities that are not on Windows 2000 servers, so it is supported for interoperability. DER certificate files use the .cer extension.

  • Base64 Encoded X.509

    This format might be used by certification authorities that are not on Windows 2000 servers, so it is supported for interoperability. Base64 certificate files use the .cer extension.

See also:

  • To import a certificate
  • To export a certificate
  • To export a certificate with the private key
  • To view the certificates in a PKCS #7 file


Viewing certificate information

Using Certificates, you can view information about the fields, extensions, and properties that define an issued certificate by double-clicking any certificate displayed in the certificate store.

To view this | See this
Overview of the certificate information | General tab
Supported uses of the certificate | General tab
Entity to which the certificate was issued | General tab
Validity period of the certificate | General tab
Path of certificate to a trusted root certification authority | Certification path tab
Root certificate | Certification path tab
Subordinate certification authorities' certificates | Certification path tab
Whether root certification authority is trusted or not | Certification path tab
Certificate status | Certification path tab

The Details dialog box provides the following information about the certificate.

Certificate field | Description
Version | The X.509 version number.
Serial number | The unique serial number that the issuing certification authority assigns to the certificate. The serial number is unique for all certificates issued by a given certification authority.
Signature algorithm | The hash algorithm that the certification authority uses to digitally sign the certificate.
Issuer | Information regarding the certification authority that issued the certificate.
Valid from | The beginning date for the period in which the certificate is valid.
Valid to | The final date for the period in which the certificate is valid.
Subject | The name of the individual or certification authority to whom the certificate is issued. If the issuing certification authority exists on a domain member server in your enterprise, this will be a distinguished name within the enterprise. Otherwise, this may be a full name and e-mail name or some other personal identifier.
Public key | The public key type and length associated with the certificate.
Thumbprint algorithm | The hash algorithm that generates a digest of data (or thumbprint) for digital signatures.
Thumbprint | The digest (or thumbprint) of the certificate data.
Friendly name | (Optional) A friendly, or common, name for the name in the Subject field.
Enhanced key usage | (Optional) The purposes for which this certificate can be used.

There are additional possible X.509v3 extensions that could be in a certificate. If they are present, they will be displayed as well.

For the procedure that shows how to see the properties of a certificate, see To view a certificate.


Using Windows 2000 Certificate Services Web pages

By default, every certification authority that is hosted on a server running Windows 2000 has Web pages available for users and administrators to perform a variety of tasks related to requesting certificates. These Web pages are located at http://servername/certsrv, where servername is the name of the Windows 2000 server that hosts the certification authority. The certsrv portion of the URL should always be in lower case letters; otherwise, users may have trouble checking and retrieving pending certificates. Users can access these Web pages using Microsoft Internet Explorer version 4.0 and greater, or Netscape Navigator version 3.01 and greater.

The Web pages are the only way for users to request certificates from stand-alone certification authorities. They are optional for users who want to request certificates from enterprise certification authorities. For more information about certification authorities, see Certificates and certification authorities.

If you have been granted access permissions, you can perform the following tasks from these Web pages:

  • Request a basic certificate. See To submit a user certificate request via the Web.
  • Request a certificate with advanced options. See To submit an advanced certificate request via the Web.

    This gives you greater control over the certificate request. Some of the user-selectable options available in an advanced certificate request include:

    • Cryptographic service provider (CSP) options. The name of the cryptographic service provider, the key size (512, 1024, and so on), the hash algorithm (SHA/RSA, SHA/DSA, MD2, MD5) and the key spec (exchange or signature).
    • Key generation options. Create a new key set or use an existing key set, mark the keys as exportable, enable strong key protection, and use the local computer store to generate the key.
    • Additional options. Save the request to a PKCS #10 file or add any specific attributes you want to add to the certificate.

    Netscape clients cannot use the advanced option Web pages.

  • Check on a pending certificate request

    If you have submitted a certificate request to a stand-alone certification authority, you will need to check the status of the pending request to see if the certification authority has issued the certificate. If the certificate has been issued, it will be available for you to install it.

  • Retrieve the certification authority's certificate to place in your trusted root store. See To retrieve a certification authority certificate.
  • Retrieve the current certificate revocation list. See To retrieve a certificate revocation list.
  • Submit a certificate request using a PKCS #10 file or a PKCS #7 file. See To request a certificate using a PKCS #10 or PKCS #7 file.
  • (For administrators only) Request a certificate for a smart card on behalf of another user. See To set up a smart card for user logon.


Common tasks with certificates

This section covers the following topics:

  • Common tasks for certificate users on an intranet
  • Common tasks for certificate users on the Internet


Common tasks for certificate users on an intranet

Task | Reference
Review certificate concepts. | Certificates overview
Requesting certificates |
Request a certificate using the Certificate Request wizard. | To request a certificate
(For advanced requests) Request a certificate using the certification authority's Web pages. | To submit an advanced certificate request via the Web
Submit a certificate request using a PKCS #10 file. Useful in cases where the certificate requester does not have a network connection to the certification authority. | To request a certificate using a PKCS #10 or PKCS #7 file
Check on a pending certificate request. | To check on a pending certificate request
Managing certificates and keys |
Export a certificate. | To export a certificate
Export a certificate with a private key. | To export a certificate with the private key
Import a certificate. | To import a certificate
Renew certificates. | To renew a certificate with a new key
Renew a certificate with the same key. | To renew a certificate with the same key


Common tasks for certificate users on the Internet

Task | Reference
Review certificate concepts. | Certificates overview
Get a certification authority's root certificate to establish trust. | To retrieve a certification authority certificate
Get the current certificate revocation list from the certification authority. | To retrieve a certificate revocation list
Requesting certificates |
Request a certificate using the certification authority's Web pages. | To submit a user certificate request via the Web
(For advanced requests) Request a certificate using the certification authority's Web pages. | To submit an advanced certificate request via the Web
Submit a certificate request using a PKCS #10 file. Useful in cases where the certificate requester does not have a network connection to the certification authority. | To request a certificate using a PKCS #10 or PKCS #7 file
Check on a pending certificate request. | To check on a pending certificate request
Managing certificates and keys |
Export a certificate. | To export a certificate
Export a certificate with a private key. | To export a certificate with the private key
Import a certificate. | To import a certificate
Renew certificates. | To renew a certificate with a new key
Renew a certificate with the same key. | To renew a certificate with the same key


Resources: Public key infrastructure

The following books provide detailed descriptions of public key encryption and public key infrastructure (PKI):

  • Ford, Warwick and Michael S. Baum, Secure Electronic Commerce: Building the Infrastructure for Digital Signatures and Encryption. Prentice Hall Press, April 1997.
  • Garfinkel, Simon and Gene Spafford, Web Security & Commerce. O'Reilly & Associates, June 1997.
  • Grant, Gail L., Understanding Digital Signatures: Establishing Trust over the Internet and Other Networks. Computing McGraw-Hill, November 1997.
  • Schneier, Bruce, Applied Cryptography: Protocols, Algorithms, and Source Code in C. John Wiley & Sons, December 1995.

The following resource describes in depth planning a public key infrastructure using Windows 2000 Certificate Services:

  • Windows 2000 Resource Kits

The following resource discusses in depth customizing Windows 2000 Certificate Services:

  • Microsoft Platform Software Development Kit

For updated technical information about Windows 2000, see Updated technical information.