Generating Certificates with Windows Certificate Services

This section describes how to create certificates using Windows Certificate Services. If necessary, you can also obtain a certificate from a remote machine. Use these certificates if you intend to run all of your applications on Windows. If you intend to run one or more applications that might require secure connections on UNIX, Genesys strongly recommends that you use OpenSSL to create your certificates.

Genesys TLS functionality requires that security certificates comply with the following requirements:

• Certificates that will be used by Genesys server applications must contain these extended attributes: serverAuth, clientAuth, and emailProtection.
• Certificates that will be used by Genesys GUI applications must contain these extended attributes: clientAuth and emailProtection.

Make sure that certificate templates are properly configured for server and GUI applications to satisfy these requirements.

Important

The examples provided in this section assume that Windows Certificate Services have been installed and configured. For information about how to install and configure Windows Certificate Services, see the appropriate Windows documentation.

Generating Certificates

To generate certificates with Windows Certificate Services, do the following:

1. Generate a certificate on a computer that is running the Windows Server operating system, and that has Windows Certificate Services installed and configured. [+] Show Steps . Open a web browser, and enter the following URL: http://<server-name>/certsrv where <server-name> is the server that runs the Windows Server operating system, and on which Windows Certificate Services is installed and configured. On the Microsoft Certificate Services Welcome page, click Request a certificate. On the Request a Certificate page, click Advanced certificate request. On the Advanced Certificate Request page, click Create and submit a request to this CA. On the subsequent Advanced Certificate Request page, enter the following information: In the Certificate Template section, select an appropriate certificate template—for example, MutualTLS2. Enter the full Name of the DNS host as a Fully Qualified Domain Name. In the Key Options section: Select Create new key set. In the Key Size text box, specify the size of the key. Select either Automatic key container name or User specified key container name, as appropriate. Select Mark key as exportable. Click Submit. After you submit the certificate request, the confirmation page appears, followed by the Certificate Issued page. On the Certificate Issued page, click Install this certificate. After you accept the system warning prompts that appear, the Certificate Installed page appears.

2. If you did not install the certificate in Step 1, retrieve and install it. [+] Show Steps On the Microsoft Certificate Services Home page, click View the status of a pending certificate request. Select the appropriate request from the list. If the certificate request is approved, the Certificate Issued page appears. Click Install this certificate to install the certificate.

3. Configure Microsoft Management Console (MMC). You can use MMC to manage certificates on a Windows platform. See Configuring MMC for Certificate Management.

4. Install the certificate and private key on the computer that hosts Genesys applications. If this computer is different from the one on which you generated the certificate, you must first export the certificate and its private key.