Creating a Certificate Signing Request

Technical Articles
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

  1. Open the Run window and enter mmc.

  2. Expand Console Root and Certificates in the left pane of the MMC window.
  3. Right-click the Personal certificate store and select All Tasks > Advanced Operations > Create Custom Request .

  4. Click Next to continue.
  5. Select "Proceed without enrollment policy", and then click Next.

  6. In the Custom Request window, select "(No template) CNG key" from the pop-up menu, make sure PKCS #10 is selected, and then click Next.

  7. In the Certificate Information window, expand the details on the custom request, and then click Properties.

  8. On the General tab, enter a friendly name and description of your choice.
  9. On the Subject tab, click the Type pop-up menu in the Subject name pane. Enter values for the following items, and click Add for each one:
    • Common name (The common name will match the DNS name.)
    • Organization
    • Organization unit
    • Locality
    • State
    • Country

  10. Still on the Subject tab, click the Type pop-up menu in the Alternative name pane. Select "DNS" from the pop-up menu, enter the Common Name/hostname in the Value field, and then click Add.
  11. On the Extensions tab, expand the Extended Key Usage section, select Server Authentication from the Available options list, and then click Add.

  12. On the Private Key tab, expand the Cryptographic Service Provider section, and ensure RSA, Microsoft Software Key Storage Provider is selected.

  13. Expand the Key options section, and ensure "Key size" is set to at least "2048".
  14. Expand the Select Hash Algorithm section, and select "sha256" or higher.

  15. Click Apply, and click OK.
  16. Click Next.
  17. When prompted to save the offline request, click Browse to select a location, include the .txt extension on the filename, and make sure File format is set to “Base 64”. Click Finish.

  18. Open the certificate request file that you saved previously, select all the text, and copy it to the clipboard.
    Note:

    If you are using a TLS server certificate issued by a trusted third-party public certificate authority to secure your HTTPS distribution point (recommended), submit this CSR to that vendor and skip to the next section. However, if the distribution point is internal-only, you can issue a TLS server certificate from Jamf Pro's built-in certificate authority. The steps to generate a CSR and issue a certificate from the built-in CA are outlined below.

  19. Do one of the following:

    • (Recommended) If you are using a TLS server certificate issued by a trusted third-party public certificate authority to secure your HTTPS distribution point, submit this CSR to that vendor and skip to the Installing the Server Certificate to the Windows Certificate Store section.

    • If the distribution point is internal-only, you can issue a TLS server certificate from built-in certificate authority. Do the following to generate a CSR and issue a certificate from the built-in CA:

      1. In Jamf Pro, navigate to Settings > Global > PKI Certificates.

      2. Use the Management Certificate Template pane to click Create Certificate from CSR.

      3. Paste the CSR text into the CSR field, and then select "Web Server Certificate" from the Certificate Type pop-up menu.

        CSR field in Create Certificate from CSR

      4. Click Create, and then specify a location to save the certificate.