Windows Server 2008 R2 Install Certificate Services and Configure SSL Website

SSL is a pki-based security protocol. If you want a website to have an SSL secure connection function, you must apply for an SSL certificate (web server certificate) from the certificate authority CA for the website. The certificate contains the public key and the validity period of the certificate. , the CA that issued this certificate, the CA’s digital signature and other data. After the website has an SSL certificate, the client and the website can communicate through an SSL secure connection.

1. Installation of root CA

Whether it is email protection or SSL website secure connection, you must apply for a certificate before you can use the public key and private key to perform data encryption and authentication operations. The organization responsible for issuing certificates is called the Certification Authority (CA). Below I will demonstrate how to install the CA certificate authority.
Insert image description here

Windows server 2008 R2	192.168.47.1
Windows XP	192.168.47.3

Preparation to test the connectivity of client and server machines (I installed CA WEB on the same server)

Insert image description here
Open Server Manager on the server

Insert image description here
Select Role>Select Add Role

Insert image description here
Select the two services we want to install, Active Directory Certificate Services and WEB Server,
and check them to proceed to the next step.

Insert image description here
Proceed to the next step after reading by default

Insert image description here
When selecting the role service, remember to check the Certificate Authority WEB registration, otherwise the certificate application will not be published on the web, which must be used later in the certificate application operation.

Insert image description here
The current server is not in the domain and is an independent server, so you can only choose to install an independent CA. Of course, domain members can also follow independent CAs (enterprise CAs will be discussed later)

Insert image description here
Select root CA

Insert image description here
Select Create a new private key

Insert image description here
Default encryption configuration with no other requirements

Insert image description here
Here you can customize the name of the CA according to your own requirements.

Insert image description here
Choose the validity period of the certificate according to the requirements. I default to five years.

Insert image description here
Database storage location, default

Insert image description here
Configure WEB server (IIS)

Insert image description here
Selected by default

Insert image description here
Confirm installation selection to start installation

Insert image description here
Wait for installation to complete

Insert image description here
The installation is complete

Insert image description here
Run certsrv.msc to open the certificate authority.

Insert image description here

At this point, it means that the certificate service is installed successfully.

Insert image description here

In the browser, enter http://localhost/certsrv Certificate Authority web application page

If the CA and WEB are separate, you need to manually trust the certificate authority

2. SSL website certificate

We must apply for an SSL certificate for the website so that the website can have the capability of SSL secure connection. If the website is to provide services to external network (Internet) users, please apply for a certificate from a commercial CA. Below I will demonstrate how to apply for a certificate for my own website and complete the setup of the SSL website.
Insert image description here
First, I changed the web authority port to 8080 and
then the access address was changed to http://192.168.47.1:8080/certsrv

Insert image description here
Address after changing the port

Insert image description here
Use Notepad to edit a web page of my own and create an html file named index under the C drive. Save it as and save it in the web folder. Change the file type to All Files and select the html web page file.

Insert image description here
Go back to IIS and choose to add a website. The physical path points to the web folder I just created.
Launch the website immediately after

Insert image description here
Go to the XP client and use the browser to access 192.168.47.1, and you can see that my web page has been published.
Next, start applying for a certificate for the web server

Insert image description here
First apply for a web server certificate, select Server Certificate > Create Certificate Application > Fill in the application information
and select Next

Insert image description here
The bit length is used to specify the bit length of the website's public key. The longer it is, the higher the security will be, but the performance will be reduced. Generally, the default is 1024 bits.
Next step

Insert image description here
Here I choose C:\Users\Administrator\Desktop\webzs.txt to save the file name and location of the certificate application file, which can be customized. But the location must be remembered clearly. It will be used in the following steps to apply for a server certificate.

Insert image description here
encoding file

Insert image description here
Enter http://192.168.47.1:8080/certsrv to start applying for a certificate

Insert image description here

Select Advanced Certificate Application Here

Insert image description here
Copy all the base64 encoded content in the certificate application file just saved on the desktop and submit the application.

Insert image description here
The application for a certificate has been suspended. The independent CA will not issue it automatically and we need to issue it manually.

Insert image description here
During operation, enter certsrv.msc to open the certificate authority. Click on the pending application to see that the application just now is suspended. Just select issuance here.
Because independent CAs will not automatically issue certificates, we need to manually issue certificates ourselves, while enterprise CAs will automatically issue certificates.

Insert image description here
After issuance, return to the home page and select to view the status of pending certificate applications.

Insert image description here
View the saved application certificate to see that the certificate has been issued.
Download it to a local custom location.

Insert image description here
Go to IIS and continue to return to the server certificate and select Complete Certificate Application. Select the certificate you just downloaded.

Insert image description here
After completion, you can see the certificate we issued.

Insert image description here
Go back to your website management and select Edit Binding to complete the final certificate binding.

Insert image description here
After entering, select Add and change the http type to https port 443. For the certificate, select the certificate we just applied for.

Insert image description here
Finally, we deleted the http binding and left only the https one.

Insert image description here
Select SSL settings

Insert image description here
Check Require SSL and choose Ignore for Client Certificates. Don’t ask for a certificate this time.
After selecting, apply the operation in the upper right corner.

Insert image description here
Restart the server

Insert image description here
Go back to the XP client and visit https://192.168.47.1. It means that it is already SSL encrypted.

Insert image description here
After selecting Yes, you can see our webpage. You can see the picture with a lock in the lower right corner showing that SSL is reliable. Next I will demonstrate the need to provide certificates to access the web.

Insert image description here
Go back to the IIS server and set up the website SSL to provide the required client certificate.

Insert image description here
When I visit again, it is mandatory to provide a digital certificate to verify identity.

Insert image description here

Visit our certificate application webpage on the xp client at http://192.168.47.1:8080/certsrv and choose to apply for a certificate

Insert image description here
Select the web browser certificate, fill in the required information and submit it

Insert image description here
The certificate application is pending. Go to the server certificate authority to issue it.

Insert image description here
Open certsrv.msc, see the pending application and choose to issue the certificate

Insert image description here
After issuance, return to the home page to check the status of the pending certificate application.

Insert image description here
Certificate has been issued

Insert image description here
Click to install this certificate

Insert image description here
When you go to visit again, the certificate you just installed can be selected. Confirm and click to start the visit.

Insert image description here
After providing the digital certificate, you can access it normally! Now is the result of requiring certificate access.
This ends the installation step.