Import TLS certificates into Windows Certificate Store
Perform the following tasks to import the TLS certificates.
Open Microsoft Management Console by pressing Windows+R to open Run, then type "mmc" in the empty box and click [ OK ].
At the top of the MMC window, select File > Add/Remove Snap-in.
In the Add or Remove Snap-ins window, select Certificates and click [ Add ].
Select the Computer account radio button and click [ Next ].
Select Local computer (selected by default) and click [ Finish ].
Back in the Add or Remove Snap-ins window, click [ OK ].
In the MMC main console, expand the Certificate snap-in.
Navigate to the Personal > Certificates pane.
Right-click within the Certificates panel and select All Tasks > Import to start the Certificate Import Wizard.
Local Machine should be selected as the Store Location. Click [ Next ] to continue.
Click [ Browse ], find and select the leaf certificate file (i.e., IgDemo.pem), then click [ Next ].
Leave the default option selected to place all certificates in the Personal certificate store, then click [ Next ].
Review the summary of the selected options, then click [ Finish ]. (Note: A notification window should pop up stating that the import was successful.)
Navigate to the Trusted Root Certificate Authorities > Certificates pane.
Right-click within the Certificates panel and select All Tasks > Import to start the Certificate Import Wizard.
Local Machine should be selected as the Store Location. Click [ Next ] to continue.
Click [ Browse ], find and select the CA certificate file (i.e., Ca.pem), then click [ Next ].
Leave the default option selected to place all certificates in the Trusted Root Certificate Authorities certificate store, then click [ Next ].
Review the summary of the selected options, then click [ Finish ].
The serial numbers of both the CA certificate and the leaf certificate need to be noted down for use in the certutil commands that follow. To do so, double-click on each of the certificates, navigate to the Details tab, and note down the listed serial number value.
Open Windows PowerShell or Command Prompt as an administrator.
Run the following command to associate the leaf certificate with its corresponding private key stored on the HSM:
Be sure to substitute "serial_number" with the actual certificate serial number value.
"My" represents the Personal certificate store.
Run the following command to associate the CA certificate with its corresponding private key stored on the :
"Root" represents the Trusted Root Certification Authorities certificate store.
For further confirmation that both certificates are now associated with their corresponding private keys on the , double-click each of the certificates in the MMC Certificates snap-in and you should now see a message stating that "You have a private key that corresponds to this certificate".