Renewing Service Certificates for NDES on Windows Server 2008 R2

Use OpenSSL. It's a command line based utility that'll generate your CSR for you. It's a 2 liner, literally! Creating your key, and then creating the CSR with that key.

1. Key Generation

openssl genrsa -des3 -out filename.key 2048

This command should create a file with name filename.key in the directory from which the > command is ran. The output will be similar to:

Generating RSA private key, 2048 bit long modulus

Enter pass phrase for filename.key: 
Verifying - Enter pass phrase for filename.key: 

Choose and enter a passphrase for filename.key and remember it because it will be needed later. Successful outcome of this use case is the key file generation. File filename.key can be viewed by using Notepad on Windows or text editor on Unix/Linux.

2. CSR Generation

openssl req -new -key filename.key -out filename.csr

where filename.key is the file generated previously. This command should create a file filename.csr that contains Certificate Signing Request. The output will look similar to:

Enter pass phrase for filename.key: 
 

You are about to be asked to enter information that will be incorporated into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank.

This procedure should create file filename.csr that contains CSR in PKCS#10 format. This CSR needs to be delivered to the CA administrator.

Successful outcome of this use case is CSR file generation. File filename.csr can be viewed by using Notepad on Windows or text editor on Unix/Linux. The content of the file should be similar to:

-----BEGIN CERTIFICATE REQUEST-----

MIIB/TCCAWYCAQAwgYExCzAJBgNVBAYTAkNBMRkwFwYDVQQIExBCcml0aXNoIENv
bHVtYmlhMRIwEAYDVQQHEwlWYW5jb3V2ZXIxETAPBgNVBAoTCFRlc3QgT3JnMRUw
...snip...

It is not possible to renew an expired certificate. You will have to issue a new certificate.

Reference: http://technet.microsoft.com/en-us/library/dd378790(WS.10).aspx

You cannot renew a certificate that has already expired. If you try to renew a certificate that has expired, the certification authority (CA) will reject the request, and you will see an error message similar to "Error Verifying Request Signature or Signing Certificate. A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file." This message will also be displayed in the Failed Requests node of the issuing CA. If your certificate has already expired, you must request a new certificate instead of renewing the existing certificate.