Step 1: Create a Certificate Authority (CA) with OpenSSL

Use the following commands to create a CA with a validity period of 10 years. The CA can be created on any machine using OpenSSL:

openssl genrsa -out ca.key 4096
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt

Go ahead and enter the asked information, here are some sample lines:

Country Name (2 letter code) [AU]: US
State or Province Name (full name) [Some-State]: New York
Locality Name (eg, city) []: New York
Organization Name (eg, company) [Internet Widgits Pty Ltd]: MyCompany
Organizational Unit Name (eg, section) []: IT
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:

Step 2: Install the Certificate Authority (CA)

• Open MMC (Microsoft Management Console) by opening PowerShell and typing “mmc”
• when opened go to “File -> Add/Remove Snap-in”
• and add “Certificates” to the list.
• Click on “Next” and select “Computer Account”, “Next”, “Local Computer”
• then “Finish” and go to the MMC window.
• Under “Trusted Root Certification Authorities”, right-click on the “Certificates” node, select “All Tasks -> Import…” and import the certificate created in step 1.

Step 3a: Create a Certificate Signing Request (CSR) the Windows way

Create a new file with .inf extension (e.g. request.inf)

;----------------- request.inf -----------------
[Version]
Signature="$Windows NT$"
[NewRequest]
Subject = "CN=ad1.server.com,OU=IT Department,DC=domain,DC=local,O=MyCompany,L=New York,S=New York,C=US";
KeySpec = 1
KeyLength = 2048
Exportable = TRUE
MachineKeySet = TRUE
SMIME = False
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0
[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1; this is for Server Authentication

Go ahead and change the Subject line to your needs. You could also raise the key length to 4096 if you want to.

Now that you created the file, create the signing request with:

certreq -new request.inf server.csr

Step 3b: Create a Certificate Signing Request (CSR) the OpenSSL way

openssl req -newkey rsa:2048 -keyout server.key -out server.csr -nodes -addext "subjectAltName=DNS:server.domain.com,IP:192.168.128.4" -addext "extendedKeyUsage=1.3.6.1.5.5.7.3.1"

Please note the extendedKeyUsage OID 1.3.6.1.5.5.7.3.1, this is important without it LDAPS will not work!

Step 4: Sign and accept the Certificate

Now you can sign the request with your CA and get the corresponding CRT:

openssl x509 -req -days 3650 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt -copy_extensions copy

Transfer the created CRT file onto the server and execute in the PowerShell:

certreq -accept server.crt

Step 5: Install the Certificate

Assuming MMC (Certificates) is still open, expand the “Certificates” node under “Personal”, right-click on the “Certificates” node, select “All Tasks -> Import…” and import MyDC.crt

Step 7: Restart Active Directory

All that’s left is to reboot your AD server. Done.