Step 1: Create a Certificate Authority (CA) with OpenSSL

Use the following commands to create a CA with a validity period of 10 years. The CA can be created on any machine using OpenSSL:

openssl genrsa -out ca.key 4096
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt

Go ahead and enter the asked information, here are some sample lines:

Country Name (2 letter code) [AU]: US
State or Province Name (full name) [Some-State]: New York
Locality Name (eg, city) []: New York
Organization Name (eg, company) [Internet Widgits Pty Ltd]: MyCompany
Organizational Unit Name (eg, section) []: IT
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:

Step 2: Install the Certificate Authority (CA)

• Open MMC (Microsoft Management Console) by opening PowerShell and typing “mmc”
• when opened go to “File -> Add/Remove Snap-in”
• and add “Certificates” to the list.
• Click on “Next” and select “Computer Account”, “Next”, “Local Computer”
• then “Finish” and go to the MMC window.
• Under “Trusted Root Certification Authorities”, right-click on the “Certificates” node, select “All Tasks -> Import…” and import the certificate created in step 1.

Step 3: Create a Certificate Signing Request (CSR)

Create a new file with .inf extension (e.g. request.inf)

;----------------- request.inf -----------------
[Version]
Signature="$Windows NT$"
[NewRequest]
Subject = "CN=ad1.server.com,OU=IT Department,DC=domain,DC=local,O=MyCompany,L=New York,S=New York,C=US";
KeySpec = 1
KeyLength = 2048
Exportable = TRUE
MachineKeySet = TRUE
SMIME = False
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0
[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1; this is for Server Authentication

Go ahead and change the Subject line to your needs. You could also raise the key length to 4096 if you want to.

Now that you created the file, create the signing request with:

certreq -new request.inf MyDC.csr

Step 4: Sign and accept the Certificate

You should now transfer the CSR back to the machine where you installed OpenSSL and sign the request with your CA and get the corresponding CRT:

openssl x509 -req -days 3650 -in MyDC.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out MyDC.crt

Transfer the created CRT file onto the server and execute in the PowerShell:

certreq -accept MyDC.crt

Step 5: Install the Certificate

Assuming MMC (Certificates) is still open, expand the “Certificates” node under “Personal”, right-click on the “Certificates” node, select “All Tasks -> Import…” and import MyDC.crt

Step 7: Restart Active Directory

All that’s left is to reboot your AD server. Done.