Installing and Configuring SSL under Windows

Installing and Configuring SSL under Windows require the following Three steps.

1. Check the system and software requirement

2. Setting Up Digital Certificates for SSL under Windows

3. Converting between PEM and DER File Formats for SSL

 

SSL under Windows: System and Software Requirements

 
The system and software requirements for using SSL under the Windows operating environment are as follows:

• a computer that runs Windows 2000 (or later). 
  
  
• depending on your configuration, access to the Internet and a Web browser such as Netscape Navigator or Internet Explorer.
  
  
• the TCP/IP communications access method.
  
  
• Microsoft Certificate Services add-on software.
  
  
• if you will run your own CA, the Microsoft Certification Authority application (which is accessible from your Web browser).
  
  
• for SAS/CONNECT, a client session that runs on a computer that has a Trusted CA Certificate. This is necessary in order for a SAS/CONNECT client session to connect to a SAS/CONNECT server session via a Windows spawner using SSL encryption.
  The Windows spawner must run on a computer that has a Trusted CA Certificate and a Personal Certificate. 
  
  
• knowledge of your site's security policy, practices, and technology. The properties of the digital certificates that you request will depend on the security policies that have been adopted at your site.
  

 Step 1. Configure SSL

Complete information about configuring your Windows operating environment for SSL is contained in the Windows installation documentation and at www.microsoft.com.
The following keywords might be helpful when searching the Microsoft Web site:

• digital certificate services
  
• digital certificate authority
  
• digital certificate request
  
• site security planning
  
  

  
  Step 2. Request a Digital Certificate

  The method of requesting a digital certificate depends on the CA that you use:
  

  	Request a Digital Certificate from the Microsoft Certification Authority
  	Request a Digital Certificate from a Certification Authority That Is Not Microsoft

  
  

  Request a Digital Certificate from the Microsoft Certification Authority

  Perform the following tasks to request digital certificates that are issued by the Microsoft Certification Authority:
  
  
• System administrator: If you are running your own CA, use Microsoft Certificate Services to create an active Certification Authority (CA).
  
  
• User:
  
  1. Use the Certificate Request wizard to request a digital certificate from an active enterprise CA. The Certificate Request wizard lists all digital certificate types that the user can install.
     
     
  2. Select a digital certificate type.
     
     
  3. Select security options.
     
     
  4. Submit the request to an active CA that is configured to issue the digital certificate.
     After the CA issues the requested digital certificate, the digital certificate is automatically installed in the Certificate Store. The installed digital certificate is highlighted, as shown in Digital Certificate Installation in the Certificate Store.
     
     Digital Certificate Installation in the Certificate Store
      
     
     

Request a Digital Certificate from a Certification Authority That Is Not Microsoft

Users should perform the following tasks to request digital certificates that are not issued by the Microsoft CA:

1. Request a digital certificate from a CA.
   
   
2. Import the digital certificate to a Certificate Store by using the Certificate Manager Import wizard application from a Web browser.
   A digital certificate can be generated by using the Certificate Request wizard or any third-party application that generates digital certificates.
   Note:   The Windows operating environment can import digital certificates that were generated in the UNIX operating environment. To convert from UNIX (PEM format) to Windows (DER format) before importing, see Converting between PEM and DER File Formats for SSL.  
   

For details about importing existing digital certificates, see Import a Digital Certificate to a Certificate Store.

Import a Digital Certificate to a Certificate Store

Digital certificates that were issued by a Certification Authority that is not Microsoft can be imported to an appropriate Certificate Store as follows:

Certificate Type	Certificate Storage Location
Client	Personal Certificate Store
Server	Personal Certificate Store
CA (self-signed)	Trusted Root Certification Authorities

Perform the following tasks to import a digital certificate to a Certificate Store:

1. Access the Certificate Manager Import wizard application from your Web browser.
   From the Tools drop-down menu, select Internet Options.
   Then select the Content tab, and click Certificates.
   Specify the digital certificate to import to a Certificate Store by selecting the Personal tab in the Certificates window, as shown in Digital Certificate Selections for a Personal Certificate Store.
   Digital Certificate Selections for a Personal Certificate Store
    
   
   
   
   
   
   
   
   
   
   
2.   Click Import and follow the instructions to import digital certificates.
   Repeat this task in order to import the necessary digital certificates for the CA, the server, and the client, as appropriate.
   
   
3. After you have completed the selections for your personal Certificate Store, select the appropriate tab to view your selections.
   
   
4. To view the details about a digital certificate, select the digital certificate and click View. Typical results are shown in Digital Certificate Details Tab.
   
   Digital Certificate Details Tab
    
   

Converting between PEM and DER File Formats for SSL

 

 By default, OpenSSL files are created in Privacy Enhanced Mail (PEM) format. SSL files that are created in Windows operating environments are created in Distinguished Encoding Rules (DER) format.

Under Windows, you can import a file that is created in either PEM or DER format. However, a digital certificate that is created in DER format must be converted to PEM format before it can be included in a trust list under UNIX.

Here is an example of converting a server digital certificate from PEM input format to DER output format:

OpenSSL> x509 -inform PEM -outform DER -in server.pem -out server.der

Here is an example of converting a server digital certificate from DER input format to PEM output format :

OpenSSL> x509 -inform DER -outform PEM -in server.der -out server.pem