ISA 2000 - Certificate Installation

Immediately after being issued, your SSL certificate will be sent to you by email. It is also possible to download the certificate from the Control Panel. The file containing the certificate will have the same name as the domain name it is meant for (for example: www_sslcertificaten_nl.crt).

See also: http://support.microsoft.com/default.aspx?scid=kb;US;292569. We assume the certificate is already installed on the IIS server, as per the SSL certificate installation in Microsoft IIS manual.

Export Certificate and Private Key from IIS

1. In IIS, start the MMC through Start → Run → type mmc.
2. Go to the Console Tab → File → Add/Remove Snap-in.
3. Choose Computer Account.
4. Choose Local Computer.
5. Close the Add Standalone Snap-in window.
6. Click Ok in the Add/Remove Snap-in window.
7. Open the Certificates Console Tree.
8. Find the folder named Personal → Certificates.
9. Select the certificate you want to back-up.
10. Right-click the file and click All Tasks → Export.
11. The Certificate Export Wizard will start. Click Ok.
12. Choose export the private key and click Next.
13. Keep the default settings and click Next.
14. Choose a password to secure the backup and click Next.
15. Save the file in a secure location. The backup has a .pfx extension.
16. Click Finish.
17. You will get a message stating The export was successful when the export is finished. Click Ok.

Import Certificate and Private Key on ISA server

1. Copy the pfx file to the ISA server
2. On the ISA server, open the MMC
3. Go to Add the Certificate snap-in as previously explained.
4. Click the Personal folder.
5. Right/click All Tasks.
6. Click Import.
7. Click Next in the Import Wizard.
8. Select the pfx file (which you have just copied to the ISA server).
9. Enter the password that you specified when exporting the pfx file.
10. Check the option Mark the private key as exportable.
11. Set the import setting to Automatically and click Finish.

Install Root and Intermediate Certificates

1. Open the MMC on the ISA server
2. Click File and select Add/Remove Snap in.
3. Select Add and select Certificates in the Add Standalone Snap-in box and click on Add.
4. Select Computer Account and click Finish.
5. Close the Add Standalone Snap-in box and click OK in the Add/Remove Snap in.
6. Go back to the MMC
7. Right-click Trusted Root Certification Authorities, select All Tasks and select Import.
8. Click Next.
9. Select the Root Certificate and click Next.
10. Click Finish after the Wizard is finished.
11. Right-click Intermediate Certification Authorities, select All Tasks and select Import.
12. Select the Intermediate CA Certificates.
13. Make sure the Root Certificate is under Trusted Root Certification Authorities and the Intermediate CA Certificate is under Intermediate Certification Authorities.
14. Restart the server to finish the installation.

Recognize your certificate by ISA

1. If there is a sub folder Certificates in the Personal folder, click Certificates and verify that a certificate is present with the name of the Web server.
2. Right-click the certificate and click Properties.
3. If the Intended Purposes field in the certificate is set to All and not to a list of specific purposes, the following steps must be followed to ensure the ISA server recognizes the certificate:
4. In the Certificate Services snap-in, open the Properties of the relevant Certificate.
5. Change the Enable all purposes option to Enable only the following purposes.
6. Select All Items and then click Apply.

Finalize the installation of the SSL certificate

1. Open the ISA Manager.
2. Right-click the server that handles the incoming connections and click Properties.
3. Click the Incoming Web Requests tab.
4. Select the Internet Protocol (IP) for the site you will be hosting, or choose all IP addresses if the individual IP-adresses are not configured.
5. Click Edit.
6. Click Use a server certificate to authenticate to web users option.
7. Click Select.
8. Select the certificate you just imported.
9. Click OK.
10. Check the Enable SSL listeners option.
11. Select Web Publishing Rules in the Publishing scroll menu.
12. Double-click the Web Publishing Rule that routes your SSL traffic.
13. On the Bridging tab, choose the Redirect SSL requests as: 'HTTP requests (terminate the secure channel at the proxy) option and click OK.
14. Restart the ISA server. Make sure to restart the entire server; don't just do a service restart.

All necessary steps to install your web server certificate have now been completed. Please make sure to adequately secure your certificate files, and to store a backup of your private key and web server certificate in a safe location. You should also install the root and intermediate certificates. Check whether the certificate is correctly installed with the SSLCheck and ensure an optimal configuration with these tips and settings.

Please do not hesitate to contact us if you encounter problems or error messages.