Create Certificate Signing Request (CSR) and Install SSL Certificate for SolarWinds Web Console

Things to consider:

• When running the configuration wizard, SolarWinds Platform will create a self-signed certificate by default.  As a best practice, self-signed certificate are not recommend for production environments.  Once the initial configuration is completed, self-signed certificates should be replace with a certificate signed by a certificate authority (CA).
• During the initial request or renewal of a certificate, it is always best practice to create a new certificate signing request.
• If any information needs to be changed after the certificate signing request was created, it is recommended to create a new certificate signing request and submit the new certificate request to the certificate authority.
• To install an issued certificate, the pending certificate request must match the issued certificate.  If the certificate signing requested was created on a different server, the certificate installation must be completed on the same Windows Server.  Once completed, the issued certificate can be exported and installed on another Windows Server.

Step 1: Create a certificate signing request from Windows Server.

1. In the Windows start menu, type Internet Information Services (IIS) Manager and open it.
2. In Internet Information Services (IIS) Manager, in the Connections menu tree (left pane), locate and click the server name.

3. On the server name Home page (center pane), in the IIS section, double-click Server Certificates.
4. On the Server Certificates page (center pane), in the Actions menu (right pane), click the Create Certificate Request… link.

5. In the Request Certificate wizard, on the Distinguished Name Properties page, provide the information specified below and then click Next:

   Common name:	Type the fully-qualified domain name (FQDN) (e.g., www.example.com).
   Organization:	Type your company’s legally registered name (e.g., YourCompany, Inc.).
   Organizational unit:	The name of your department within the organization. Frequently this entry will be listed as "IT", "Web Security,"
   	or is simply left blank.
   City/locality:	Type the city where your company is legally located.
   State/province:	Type the state/province where your company is legally located.
   Country:	In the drop-down list, select the country where your company is legally located.

   

6. On the Cryptographic Service Provider Properties page, provide the information below and then click Next.

   Cryptographic	In the drop-down list, select Microsoft RSA SChannel Cryptographic Provider,
   service provider:	unless you have a specific cryptographic provider.
   Bit length:	In the drop-down list select 2048, unless you have a specific reason
   	for opting for larger bit length.

   

7. On the File Name page, under Specify a file name for the certificate request, click the … box to browse to a location where you want to save your CSR.

   Note: Remember the filename that you choose and the location to which you save your csr.txt file. If you just enter a filename without browsing to a location, your CSR will end up in C:\Windows\System32.

   

8. When you are done, click Finish.
9. Use a text editor (such as Notepad) to open the file. Then, copy the text, including the -----BEGIN NEW CERTIFICATE REQUEST----- and -----END NEW CERTIFICATE REQUEST----- tags, and paste it into the DigiCert order form.

10. Ready to order your SSL certificate

11. After you receive your SSL certificate from DigiCert, you can install it.

Step 2: How to Install and Configure your own SSL Certificate on Windows Server

Install SSL Certificate

1. On the server where you created the CSR, save the SSL certificate .cer file (e.g., your_domain_com.cer) that DigiCert sent to you.
2. In the Windows start menu, type Internet Information Services (IIS) Manager and open it.
3. In Internet Information Services (IIS) Manager, in the Connections menu tree (left pane), locate and click the server name.

4. On the server name Home page (center pane), in the IIS section, double-click Server Certificates.
5. On the Server Certificates page (center pane), in the Actions menu (right pane), click the Complete Certificate Request… link.

• If the certificate signing request was created on a different server, complete the installation on following Windows Server first, then export the certificate. 
• If a certificate signing request was not created, please create a new certificate signing request and submit the request to the certificate authority to replace the existing certificate. Once a new certificate is issued, complete the certificate request.

6. In the Complete Certificate Request wizard, on the Specify Certificate Authority Response page, do the following and then click OK:

   File name containing the	Click the … box and browse to and select the certificate file.   The recommended format is PKCS#7 (PEM or DER).  If PKCS#7 is not available, certificate with chain certificates included.
   certificate authority's response:	(e.g., your_domain_com.cer) that DigiCert sent to you.
   Friendly name:	Type a friendly name for the certificate.
   	The friendly name is not part of the certificate; instead, it is used to identify the certificate.
   	We recommend that you add DigiCert and the expiration date to the end of your friendly name, for example: yoursite-digicert-(expiration date).
   	This information helps identify the issuer and expiration date for each certificate. It also helps distinguish multiple certificates with the same domain name.
   Select a certificate store	In the drop-down list, select Web Hosting.
   for the new certificate:

   

7. SSL certificate is successfully installed

​​​​​​​Step 3: Assign SSL Certificate

1. In Internet Information Services (IIS) Manager, in the Connections menu tree (left pane), expand the name of the server on which the certificate was installed. Then expand Sites and click the site you want to use the SSL certificate to secure.

2. On the website Home page, in the Actions menu (right pane), under Edit Site, click the Bindings… link.
3. In the Site Bindings window, click Add.

4. In the Add Site Bindings window, do the following and then click OK:

   Type:	In the drop-down list, select https.
   IP address:	In the drop-down list, select the IP address of the site or select All Unassigned.
   Port:	Type port 443. The port over which traffic is secure by SSL is port 443.
   SSL certificate:	In the drop-down list, select your new SSL certificate (e.g., yourdomain.com).

   

5. SSL certificate is now installed, and the website configured to accept secure connections.

   

Related Links:

• What is the difference between a self-signed certificate vs certificate signed by a certificate authority (CA)? ​​​​​​​