Skip to main content
This section shows how to generate a Certificate Signing Request (CSR) from a certreq policy file on the computer where you plan to install Microsoft AD RMS. Then, it describes creating a public/private key pair in your Windows account profile after you generate the CSR file. In a later section, the KMES issues a signed certificate from the CSR, for you to associate with the public/private key pair stored in the Windows Certificate Store.

​
Create a policy file

Perform the following steps to create a Certreq policy file:
1
On the computer where you plan to install Microsoft AD RMS, open a text editor.
2
Create a new file, then copy and paste the following content into that file:
None
[Version]
Signature = "$Windows NT$"

[NewRequest]
Subject = "CN=ADRMS"
Exportable = TRUE
KeyLength = 2048
MachineKeySet = TRUE
3
Save the file with the .inf extension (such as certreq_policy.inf).

​
Generate a CSR

Perform the following steps to generate a CSR from the Certreq policy file:
1
Open either the command prompt or PowerShell.
2
Go to the directory with the certreq policy .inf file.
3
Run the following command to generate a certificate signing request (CSR) from the certreq policy .inf file:
Powershell
certreq -new -q -config "your.domain.com\Microsoft ADRMS" certreq_policy.inf ADRMS.csr
4
Copy the CSR file to the storage medium configured on your KMES Series 3.