Bridge SSL
Bridge CDN →

Generate a CSR in IIS: the wizard, certreq and where the key stays

11 min readUpdated

To generate a CSR in IIS, open Server Certificates in IIS Manager and choose Create Certificate Request… [1]. The wizard asks for the subject, a cryptographic service provider and a bit length, then writes the request to a file you name. The private key stays on that server; the response installs only on the computer that sent the request [2]. This page is the first half of installing an SSL certificate on IIS.

For several names on one certificate, use certreq with an INF file: the wizard has a common name field and none for other names [1] [5]. Steps shared by every server are on install SSL certificates.

Where
IIS Manager, Server Certificates, Create Certificate Request… [1]
Key size
RSA of at least 2048 bits, or ECDSA on P-256, P-384 or P-521 [4]
Wizard default
1024-bit RSA in IIS 7, below that minimum [1]
Command line
certreq -new -machine request.inf example.com.req [5]
To finish
Complete Certificate Request… or certreq -accept, on the same computer [2] [5]

Wizard or certreq

Both run on the server that will use the certificate and write a request file for the authority. The certreq example below sets RequestType = PKCS10, the request format defined in RFC 2986 [5] [9]. The two differ in what you can put into the request.

IIS Manager wizardcertreq with an INF file
Namesone common name [1]common name plus a subject alternative name list [5]
KeyRSA SChannel or DH SChannel provider, bit length from a list [1]KeyAlgorithm RSA or ECDSA_P256, ECDSA_P384, ECDSA_P521, KeyLength [5]
Exportable keyno option on the wizard pages [1]Exportable = TRUE or FALSE [5]
CompletingComplete Certificate Request… [2]certreq -accept [5]

What you need

  • Administrator rights on the server. The local computer store is shared by every user of the machine; without administrator rights you can manage certificates only for your own account [10].

  • The exact hostnames the certificate must cover, for example example.com and www.example.com.

  • For organisation-validated certificates, your organisation's registered name and location, typed as the authority will verify them.

Create the request in IIS Manager

Microsoft documents the wizard page by page for IIS 7 [1]. Its IIS 10.0 procedure uses the same Server Certificates feature and finishes with Complete Certificate Request in the same Actions pane [3].

  1. Open IIS Manager and select the server in Connections. In Features View, double-click Server Certificates.

  2. In Actions, choose Create Certificate Request…. The Request Certificate wizard opens.

  3. On Distinguished Name Properties, type the hostname the site answers on as the Common name [1]. Organization, City/locality and State/province are for an organisation-validated certificate, which must carry the organisation, the country and a city or state; a domain-validated certificate carries at most the country and the common name [4]. For an organisation-validated certificate, write city and state names in full. Leave Organizational unit empty: the Baseline Requirements do not allow that attribute in domain-validated or organisation-validated certificates [4].

  4. On Cryptographic Service Provider Properties, select Microsoft RSA SChannel Cryptographic Provider and a Bit length of 2048 or more.

  5. On File Name, enter a path for the request file and click Finish [1].

  6. Open the file in a text editor and send the whole text to the authority, including the first and last lines.

Subject fields and signing requests in general are covered in the CSR guide of the certificates section.

Choose the key size

The bit length you pick on the cryptographic service provider page decides whether the CSR you generate in IIS is usable at all. The Baseline Requirements allow RSA keys whose modulus is at least 2048 bits, and ECDSA keys on NIST P-256, P-384 or P-521; no other algorithms or key sizes are permitted [4]. An authority must reject a request whose private key does not meet these sizes [4].

The IIS 7 wizard defaults to 1024 bits for the RSA SChannel provider, and the DH SChannel provider uses 512 [1]. Change the bit length before clicking Next, and leave the DH provider alone: DH is not among the permitted algorithms.

Create the request with certreq

certreq -new builds a request from an INF file [5]. Use it to create a CSR for IIS when the certificate needs a subject alternative name list, or when you want the private key settings written down rather than chosen in a dialog. Save this as request.inf:

[Version]
Signature=$Windows NT$

[NewRequest]
Subject = "CN=example.com"
KeyAlgorithm = RSA
KeyLength = 2048
KeySpec = 1
KeyUsage = 0xa0
MachineKeySet = TRUE
Exportable = FALSE
HashAlgorithm = sha256
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10

[EnhancedKeyUsageExtension]
OID = 1.3.6.1.5.5.7.3.1

[Extensions]
2.5.29.17 = "{text}"
_continue_ = "DNS=example.com&"
_continue_ = "DNS=www.example.com"

Then, in an elevated prompt on the server that will use the certificate:

certreq -new -machine request.inf example.com.req

The output is a base64-encoded request file [6].

What the INF keys do

  • MachineKeySet = TRUE creates the key for the computer, not for you. Key material is kept in the security context of whoever created the request; a key created in an administrator's context is one the machine cannot access [5]. The -machine option must agree with it [5].

  • 2.5.29.17 is the subject alternative name extension; each _continue_ line adds a name [5]. A publicly trusted certificate must carry that extension, and a common name, if present, must be one of those names [4].

  • OID = 1.3.6.1.5.5.7.3.1 asks for server authentication [6].

  • KeyUsage = 0xa0 is digital signature and key encipherment [5].

  • HashAlgorithm = sha256 is set explicitly: Microsoft's certreq reference notes that its content follows default settings that include SHA1 [5], and Microsoft's Operations Manager example sets SHA256 [7].

  • Exportable = FALSE follows Microsoft's advice that private keys shouldn't be exportable, unless several machines must share the key [5].

From PowerShell

certreq is an executable, so the same command runs in PowerShell started as administrator. When you pipe or redirect its output in a script, add -unicode, which Microsoft describes as helping when certreq is invoked from Windows PowerShell scripts [5].

Check the request before you send it

Read the CSR back before it reaches the authority, whichever tool generated it:

certutil -dump example.com.req

certutil -dump prints the contents of a file [11]. Check the subject and every subject alternative name, the bit length of the public key, and the signature algorithm. A missing name costs a new request after issuance.

The text file starts with a -----BEGIN line. RFC 2986 requests in this text form are labelled CERTIFICATE REQUEST by RFC 7468, which also notes that the label NEW CERTIFICATE REQUEST is in wide use and that parsers may treat the two as equivalent [12]. Send the file as it is.

Where the private key stays

The private key is not in the CSR. A request carries a distinguished name, a public key and optional attributes, signed with the private key [9]; the key itself stays on the server.

For IIS, Microsoft states one rule: the response can be installed only on the computer from which the request was sent [2]. The mechanics are documented for the Windows certificate enrollment API. Creating a request generates the key pair and places a placeholder certificate in the request store; installing the response reads that placeholder and takes the private key from it [8]. With certreq, the key container is generated and maintained by the system [5]. Microsoft's Operations Manager procedure points to Certificates (Local Computer) > Certificate Enrollment Requests when a requested certificate does not show up in Personal [7].

  1. Complete on the same computer, the one that sent the request [2].

  2. Keep the pending request. Without it the response has no key to pair with [8], and a new CSR is needed.

  3. Use the same context. A request created without MachineKeySet belongs to the account that made it [5].

Complete the request

When the authority returns the certificate:

  • IIS Manager: in Server Certificates, choose Complete Certificate Request…, select the authority's file, enter a friendly name and choose the store [3]. The friendly name is a label, not part of the certificate [3].

  • certreq: run certreq -accept example.com.cer. It links the previously generated private key with the issued certificate and removes the pending request [5]. While a matching request is outstanding, no -user or -machine option is needed; without one, you must specify the context [5].

After certreq -accept, the certificate is in the computer's Personal store [6]; after the IIS dialog, in the store you chose [3]. Binding it to a site, importing intermediates and checking the result are the next steps of the IIS installation guide.

Common mistakes

  • 1024-bit key. The IIS 7 wizard default [1] is below the 2048-bit minimum; an authority must reject the request [4].

  • Only one name. The wizard has no field for subject alternative names [1]; for example.com and www.example.com together, use certreq.

  • Request on one server, response on another. Complete it where the request was made [2], then move the certificate and key as a PFX file.

  • Certificate present, key missing. If the key is still on the server, certutil -repairstore repairs a key association [11]; if it is not, request again.

Servers configured with key files, such as when you install an SSL certificate on Apache, create the key and request with OpenSSL instead and keep both as files.

FAQ

Where is the private key stored for an IIS CSR request?

On the server that created the request, and not in the CSR. Microsoft states that the response installs only on that computer. In the Windows enrollment API the key waits with a placeholder certificate in the request store until the response is installed.

How do I get the CSR from IIS?

The wizard writes it to the file name you enter on its last page. Open that file in a text editor and copy the whole text, including the BEGIN and END lines.

Can I convert a CSR to a PFX?

No. A CSR carries the public key and no private key, while a PFX holds the certificate together with its private key. Complete the request first; then certutil -exportPFX exports the certificate and its key into a PFX file, provided the key was created exportable.

How do I view a CSR before submitting it?

Run certutil -dump example.com.req on Windows and check the names and key length it shows.

Sources

  1. Microsoft Learn, Request an Internet Server Certificate (IIS 7): wizard pages, providers and default bit lengths.

  2. Microsoft Learn, Install an Internet Server Certificate (IIS 7): the response installs only on the computer that sent the request.

  3. Microsoft Learn, PowerScribe One SSL certificate renewal: the IIS 10 Complete Certificate Request dialog.

  4. CA/Browser Forum Baseline Requirements, version 2.3.1: §6.1.1.3 subscriber key pair generation, §6.1.5 key sizes, §7.1.2.7.2 and §7.1.2.7.4 domain- and organisation-validated subject attributes, §7.1.2.7.6 subscriber certificate extensions, §7.1.4.3 common name.

  5. Microsoft Learn, certreq: -new, -accept, -machine, -unicode, INF keys.

  6. Microsoft Learn, Enable LDAP over SSL with a third-party certification authority: example request INF, certreq -new, certreq -accept, Personal store.

  7. Microsoft Learn, Obtain a certificate for use with Windows Servers and System Center Operations Manager: SHA256 INF, Certificate Enrollment Requests.

  8. Microsoft Learn, IX509Enrollment::CreateRequest and IX509Enrollment::InstallResponse.

  9. IETF, RFC 2986, PKCS #10: Certification Request Syntax Specification, version 1.7.

  10. Microsoft Learn, How to: View certificates with the MMC snap-in.

  11. Microsoft Learn, certutil: -dump, -repairstore, -exportPFX.

  12. IETF, RFC 7468, Textual Encodings of PKIX, PKCS, and CMS Structures, section 7.