Log in to the CryptoHub web UI
1
Go to the hostname or IP address of the CryptoHub web UI in your browser.
2
Log in with your administrator users.
Create an X.509 Certificate Container
1
Go to PKI and CA > Certificate Management.
2
Select [ Add CA ].
3
In the X.509 Certificate Container creation dialog, configure the following settings:
- Name: Windows Certificate Store
- Host: None
- Type: X.509
- Owner group: Select the Windows Certificate Store role created for the service
Generate a root CA certificate
1
Right-click the certificate container you created and select Add Certificate > New Certificate.
2
Configure the following Subject DN settings:
- Preset: Classic
- Common Name: Root
3
Configure the following Basic Info settings:
- Profile: Select Certificate Authority
4
Select [ OK ].
Issue a leaf certificate
1
Right-click the Root CA certificate and select Add Certificate > New Certificate.
2
Configure the following Subject DN settings:
- Preset: Classic
- Common Name: Leaf
3
Configure the following Basic Info settings:
- Leave the fields set to the default values.
4
Configure the following V3 Extensions settings:
- Profile: Select TLS Client Certificate
5
Select [ OK ].
Export the certificates
1
Right-click the Root CA certificate and select Export > Certificate(s).
2
Change Encoding to PEM and select [ Browse ].
3
Specify a filename for web transfer (e.g.,
leaf-cert.pem) and select [ OK ].4
Select [ OK ] to initiate the export.
5
When prompted, save the certificate file.
6
Repeat steps 1-5 for the Leaf certificate.
Assign names to the private keys
1
Go to Key Management > Key Database.
2
Right-click the Leaf key pair in the Keys section and select Edit.
3
Under Key Settings, enter “Leaf” in the Name field and select [ OK ] to save.
4
Right-click the Root key pair in the Keys section and select Edit.
5
Under Key Settings, enter “Root” in the Name field and select [ OK ] to save.
Give the Windows Certificate Store role permissions to use the private keys
1
Go to Key Management > Key Database.
2
Right-click the Leaf key pair in the Keys section and select Permission.
3
Select Service - Windows Certificate Store in the dropdown menu and select [ Add ].
4
Grant the Use permission and select [ Save ].
5
Repeat steps 1-4 for the Root key pair.