Skip to main content
The following section imports the CA and leaf certificates created on the Vectera Plus in the previous section into the Windows Certificate Store. Then, you can use the certutil command-line utility to associate the certificates with their corresponding private keys stored on the HSM.

​
Import the certificates

Perform the following steps to import the certificates by using Microsoft Management Console (MMC) and the Certificates Snap-in:
1
Open Microsoft Management Console by pressing Windows+R to open Run, and enter mmc in the empty text box. Select [ OK ].
2
At the top of the MMC window, select File > Add/Remove Snap-in.
3
In the Add or Remove Snap-ins window, select Certificates and select [ Add ].
4
Select the Computer account radio button and select [ Next ].
5
Select Local computer (selected by default) and select [ Finish ].
6
Back in the Add or Remove Snap-ins window, select [ OK ].
7
In the MMC main console, expand the Certificate snap-in.
8
Go to the Personal > Certificates pane.
9
Right-click within the Certificates panel and select All Tasks > Import to start the Certificate Import Wizard.
10
Select Local Machine as the Store Location. Select [ Next ] to continue.
11
Click Browse, find and select the leaf certificate file (IgDemo.pem), and select [ Next ].
12
Leave the default option selected to place all certificates in the Personal certificate store and select [ Next ].
13
Review the summary of the selected options and select [ Finish ].
A notification window should pop up stating that the import was successful.
14
Go to the Trusted Root Certificate Authorities > Certificates pane.
15
Right-click within the Certificates panel and select All Tasks > Import to start the Certificate Import Wizard.
16
Select Local Machine as the Store Location. Select [ Next ] to continue.
17
Select [ Browse ], find and select the CA certificate file (Ca.pem), and select [ Next ].
18
Leave the default option selected to place all certificates in the Trusted Root Certificate Authorities certificate store and select [ Next ].
19
Review the summary of the selected options and select [ Finish ].

​
Associate the certificates

Perform the following steps to associate the certificates with their corresponding private keys stored on the HSM by using certutil:
1
Note the serial numbers of both the CA certificate and the leaf certificate for use in the following certutil commands. To do so, perform the following steps:
  1. Double-click on each certificate.
  2. Go to the Details tab.
  3. Note the listed serial number value.
2
Open Windows PowerShell or Command Prompt as an administrator.
3
Run the following command to associate the leaf certificate with its corresponding private key stored on the HSM, substituting serial_number with the actual certificate serial number value:
The My element represents the Personal certificate store.
Powershell
certutil -repairstore -csp "Futurex CNG" My "serial_number"
4
Run the following command to associate the CA certificate with its corresponding private key stored on the HSM:
The Root element represents the Trusted Root Certification Authorities certificate store.
Powershell
certutil -repairstore -csp "Futurex CNG" Root "serial_number"
5
For further confirmation that both certificates are now associated with their corresponding private keys on the HSM, double-click each of the certificates in the MMC Certificates snap-in.
If it works, you should now see a message stating that you have a private key that corresponds to this certificate.