The Certificate Enrollment Policy Web Service is installed as an application in Microsoft Internet Information Services (IIS). Microsoft IIS requires a TLS certificate so that the Certificate Enrollment Policy Web Service can accept WSTEP enrollment requests over HTTPS.

The following procedure describes how to to create a certificate signing request (CSR) in Microsoft IIS for a certificate. A CSR contains information that the issuing CA will use to create the certificate. Entrust PKI as a Service or an on-premises CA can process the CSR and issue the certificate.

To create a CSR for Microsoft IIS

  1. Open the Internet Information Services (IIS) Manager. Select Start > Windows Administrative Applications > Internet Information Services (IIS) Manager.
    The Internet Information Services (IIS) Manager dialog box appears.

  2. Under Connections, select the host name of the server.

  3. In the Home pane, double-click Server Certificates.
  4. In the Actions pane, click Create Certificate Request.
    The Request Certificate wizard appears.
  5. The Distinguished Name Properties page appears.

    1. In the provided fields, enter information that will be included in the CSR. Note that the issuing CA (either a CA in Entrust PKI as a Service, or an on-premises Entrust CA) will ignore this information.
    2. Click Next.
  6. The Cryptographic Service Provider Properties page appears.

    1. From the Cryptographic service provider drop-down list, select a cryptographic service provider. It is recommended that you select Microsoft RSA SChannel Cryptographic Provider.

    2. In the Bit length list, select a bit length. It is recommended that you select 2048 as the bit length.
    3. Click Next to continue.

  7. The File Name page appears.

    1. In the text field, enter a path and file name for the file that will contain the Web server certificate request.

    2. Click Finish.

  8. The CSR is saved in the file you specified in the previous step.