Install the certificate on the IIS server

The private key stays on the CryptoHub. After exporting the certificate from the CryptoHub (see Create and export the key and certificate on the CryptoHub), you install only the public certificate and its issuing CA chain on the IIS server, then bind the certificate to the CryptoHub key through the FXCL CNG provider.

Install the certificates on the IIS server

Import the CA certificate into the machine Trusted Root Certification Authorities store (and any intermediates into Intermediate Certification Authorities) so the chain is trusted:

PowerShell

Import-Certificate -FilePath C:\stage\ca.cer -CertStoreLocation Cert:\LocalMachine\Root

Import the leaf (server) certificate into the machine Personal store:

PowerShell

Import-Certificate -FilePath C:\stage\iis_cert.cer -CertStoreLocation Cert:\LocalMachine\My

The certificate appears in certlm.msc > Personal > Certificates. At this point it does not yet show an associated private key. The next step creates that association.

Bind the installed certificate to its CryptoHub-resident key through the FXCL CNG provider. Use the certificate’s serial number (visible in certlm.msc or through Get-ChildItem Cert:\LocalMachine\My):

PowerShell

certutil -f -csp "Futurex FXCL KMES CNG" -repairstore My "<CertificateSerialNumber>"

The output should include Signature test passed, confirming the installed certificate is bound to the HSM-resident key through the Futurex provider, and certlm.msc now shows the certificate with an associated private key.

Confirm the certificate resolves to the Futurex provider (not the Microsoft Software KSP):

PowerShell

$c = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.SerialNumber -eq "<CertificateSerialNumber>" }
$c.HasPrivateKey
[System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($c).Key.Provider

HasPrivateKey is True and the provider reports Futurex FXCL KMES CNG.

⌘I

​Install the certificates on the IIS server

Install the certificates on the IIS server