

Applies to: Windows Server 2008 StandardWindows Server 2008 DatacenterWindows Server 2008 Enterprise More



More Information


Requirements for an LDAPS certificate

    • The Common Name (CN) in the Subject field.
    • DNS entry in the Subject Alternative Name extension.
  • You must use the Schannel cryptographic service provider (CSP) to generate the key.
For more information about establishing trust for certificates, see the "Policies to establish trust of root certification authorities" topic in Windows 2000 Server Help.

Creating the certificate request


Note The commands that are used in this article rely on the 2003 version of Certreq. In order to use the steps in this article on a Windows 2000 server, copy certreq.exe and certcli.dll from a Windows 2003 server into a temporary directory on the Windows 2000 server.




    Signature="$Windows NT$


    KeySpec = 1
    KeyLength = 1024
    ; Larger key sizes are more secure, but have
    ; a greater impact on performance.
    Exportable = TRUE
    MachineKeySet = TRUE
    SMIME = False
    PrivateKeyArchive = FALSE
    UserProtected = FALSE
    UseExistingKeySet = FALSE
    ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
    ProviderType = 12
    RequestType = PKCS10
    KeyUsage = 0xa0


    OID= ; this is for Server Authentication


    Note Some third-party certification authorities may require additional information in the Subject parameter. Such information includes an e-mail address (E), organizational unit (OU), organization (O), locality or city (L), state or province (S), and country or region (C). You can append this information to the Subject name (CN) in the Request.inf file. For example: Subject=", CN=<DC fqdn>, OU=Servers, O=Contoso, L=Redmond, S=Washington, C=US."
  2. Create the request file. To do this, type the following command at the command prompt, and then press ENTER:
    certreq -new request.inf request.req
    A new file called Request.req is created. This is the base64-encoded request file.
  4. Retrieve the certificate that is issued, and then save the certificate as Certnew.cer in the same folder as the request file. To do this, follow these steps:
    1. Create a new file called Certnew.cer.
  5. Accept the issued certificate. To do this, type the following command at the command prompt, and then press ENTER:
    certreq -accept certnew.cer
  6. Verify that the certificate is installed in the computer's Personal store. To do this, follow these steps:
    1. Start Microsoft Management Console (MMC).
  7. Restart the domain controller.
For more information about creating the certificate request, see the following Advanced Certificate Enrollment and Management white paper. To view this white paper, visit the following Microsoft Web site:

Verifying an LDAPS connection

  1. Start the Active Directory Administration Tool (Ldp.exe).

    Note This program is installed in the Windows 2000 Support Tools.
  2. On the Connection menu, click Connect.
  4. Type 636 as the port number.
  5. Click OK.


Possible issues

  • Start TLS extended request
  • Multiple SSL certificates
  • Pre-SP3 SSL certificate caching issue

Windows Server 2008 improvements

The original recommendation in this article was to put certificates in the Local Machine's Personal store. Although this option is supported, you can also put certificates in the NTDS Service's Personal certificate store on Windows Server 2008 and on later versions of Active Directory Domain Services (AD DS). For more information about how to add the certificate to the NTDS service's Personal certificate store, visit the following Microsoft TechNet Web site:AD DS preferentially looks for certificates in this store over the Local Machine's store. This makes it easier to configure AD DS to use the certificate that you want it to use. This is because there might be multiple certificates in the Local Machines Personal store, and it can be difficult to predict which one is selected.


