Create a Company Certificate

During the installation of the empower^® Backend, you need a certificate.

Here, you have the option to use a company certificate. This certificate needs to be created in advance.

Note

For further information regarding the SSL certificate types, see SSL Certificates.

For further information regarding the installation of the empower^® Backend Install the empower^® Backend (Version >= 9.7).

Apply for PKI Certificates

The process of applying for and issuing Private Key Infrastructure (PKI) certificates is not dependent on any particular technology. It follows this pattern:

A public and private key will be generated to represent the identity.
A Certificate Signing Request (CSR) is generated by using the public key and some information about the identity.
The certificate authority uses information from the CSR, your own public key, authorization information, and a signature generated by your own private key to create a certificate.

The details of these steps vary between implementations. Please focus on the issuing.

You do not need any further details. There is a specific process for issuing a certificate.

Every certificate authority has a process that determines whether you will be issued with a certificate or not.

Generate a Certificate Signing Request Using MMC

The MMC registration offers a high level of flexibility. You can request certificates for you, your own computer or another entity. You can request certificates using MMC with all Windows versions and Windows servers. The only requirement is a graphical user interface.
To do so, follow the following steps:
Start the Microsoft Management Console (MMC) by searching for MMC in the Windows search. Open the tab File. Choose the option Add/Remove Snap-in… (Figure 1, “Option Add/Remove Snap-in…”).	Figure 1. Option Add/Remove Snap-in…
Choose the option Certificates (Figure 2, “Add Certificate” (1)). Confirm your choice by clicking on the button Add (Figure 2, “Add Certificate” (2)).	Figure 2. Add Certificate
Select the option Computer account (Figure 3, “Option Computer account”). Alternatively, you can choose one of the other options. If you choose the option Service account or Computer account, the dialog box switches to the computer selection. If you choose another computer rather than your local computer, it shows the certificate storage of it and saves all changes in the respective storage.	Figure 3. Option Computer account
In the next step, choose the option Local computer (Figure 4, “Option Local computer” (1)). Confirm your choice by clicking on the button Finish (Figure 4, “Option Local computer” (2)).	Figure 4. Option Local computer
Double-click on Certificates (local computer) to expand the view (Figure 5, “Create Custom Request” (1)). Right-click on the folder Personal (Figure 5, “Create Custom Request” (2)). Choose the option All Tasks (Figure 5, “Create Custom Request” (3)). Then choose the option Advanced Operations (Figure 5, “Create Custom Request” (4)). Then, choose the option Create Custom Request (Figure 5, “Create Custom Request” (5)). A dialog box opens.	Figure 5. Create Custom Request
Click on the button Next (Figure 6, “Certificate Enrollment Start Screen”).	Figure 6. Certificate Enrollment Start Screen
Choose the option Proceed without enrollment policy (Figure 7, “Enrollment Policy” (1)). Click on the button Next (Figure 7, “Enrollment Policy” (2)).	Figure 7. Enrollment Policy
Select the option (No template) Legacy key for the template and the option PKCS#10 for the requested format (Figure 8, “Options for Custom Request” (1)). Confirm the selections by clicking on the button Next (Figure 8, “Options for Custom Request” (2)).	Figure 8. Options for Custom Request
Expand the view by clicking on the button Details (Figure 9, “Certificate Information” (1)). Then, click on the button Properties (Figure 9, “Certificate Information” (2)).	Figure 9. Certificate Information
Under General, choose a name and a description (Figure 10, “General Properties”).	Figure 10. General Properties
Navigate to the tab Subject. Under Subject name, choose the option Common name for Type (Figure 11, “Subject Properties” (1)). For Value, enter your domain (Figure 11, “Subject Properties” (2)). Click on the button Add (Figure 11, “Subject Properties” (3)). Repeat this process under Alternative name with the same input.	Figure 11. Subject Properties
Navigate to the tab Private Key. Expand the section Cryptographic Service Provider (Figure 12, “Cryptographic Service Provider”). Make sure the only option selected is Microsoft RSA SChannel Cryptographic Provider (Encryption) (Figure 12, “Cryptographic Service Provider”).	Figure 12. Cryptographic Service Provider
Expand the section Key options. For Key size, choose the option 4096 (Figure 13, “Key Options”). Make sure the checkbox for Make private key exportable is ticked (Figure 13, “Key Options”).	Figure 13. Key Options
Expand the section Key type. Choose the option Exchange (Figure 14, “Key Type”). Click on the button Apply. Then, click on the button OK. The dialog box closes. Click on the button Next.	Figure 14. Key Type
Enter a name for the file and choose a storage locations (Figure 15, “Save Request” (1)). Under File format, choose the option Base 64 (Figure 15, “Save Request” (2)). Click on the button Finish.	Figure 15. Save Request

Export Certificate to PFX with Private Key

For the import to the backend, a .pfx file is required. To create a .pfx file which includes the certificate as well as the private key, follow the following steps:
Open the folder Certificate Enrollment Requests (Figure 17, “Subfolder Certificates”).	Figure 16. Folder Certificate Enrollment Requests
Navigate to the subfolder Certificates (Figure 17, “Subfolder Certificates”).	Figure 17. Subfolder Certificates
Right-click on the required certificate (Figure 18, “Required Certificate”). A context menu opens.	Figure 18. Required Certificate
Choose the option All Tasks (Figure 19, “Option Export” (1)). Then, choose the option Export (Figure 19, “Option Export” (2)). The Certificate Export Wizard opens.	Figure 19. Option Export
Click on the button Next (Figure 20, “Certificate Export Wizard”).	Figure 20. Certificate Export Wizard
Choose the option Yes, export the private key (Figure 21, “Export Private Key”). Click on the button Next.	Figure 21. Export Private Key
Configure the format for the export file (Figure 22, “Configure Format”). To do so, enable the following options: Include all certificates in the certification path if possible Expand all extended properties Enable certificate privacy If the key should remain on the system, disable the option Delete private key after successful upload. Click on the button Next.	Figure 22. Configure Format
Enter a password to protect the private key (Figure 23, “Export Security” (1)). Confirm the password. Choose your encryption method (Figure 23, “Export Security” (2)). It is recommended to choose the option AES256-SHA256. Click on the button Next.	Figure 23. Export Security
Select the storage location for the .pfx file (Figure 24, “Save .pfx File”). Enter a file name. Click on the button Next.	Figure 24. Save .pfx File
To finish the export, click on the button Finish (Figure 25, “Finish Export”).	Figure 25. Finish Export
After finishing the export, you can find the .pfx file under the specified storage location. This file can now be imported to the empower^® Backend using the empower^® Backend Installer.