Import TLS certificates into Windows Certificate Store
Perform the following tasks to import the TLS certificates.
Perform the following steps to import the certificates by using Microsoft Management Console (MMC) and the Certificates Snap-In:
Open Microsoft Management Console by pressing Windows+R to open Run, then type "mmc" in the empty box and select [ OK ].
At the top of the MMC window, select File > Add/Remove Snap-in.
In the Add or Remove Snap-ins window, select Certificates and select [ Add ].
Select the Computer account radio button and select [ Next ].
Select Local computer (selected by default) and select [ Finish ].
Back in the Add or Remove Snap-ins window, select [ OK ].
In the MMC main console, expand the Certificate snap-in.
Go to the Personal > Certificates pane.
Right-click within the Certificates panel and select All Tasks > Import to start the Certificate Import Wizard.
Select Local Machine as the Store Location. Select [ Next ] to continue.
Select [ Browse ], find and select the leaf certificate file (such as IgDemo.pem), and select [ Next ].
Leave the default option selected to place all certificates in the Personal certificate store, and select [ Next ].
Review the summary of the selected options, and select [ Finish ].
A notification window states that the import was successful.
Go to the Trusted Root Certificate Authorities > Certificates pane.
Right-click within the Certificates panel and select All Tasks > Import to start the Certificate Import Wizard.
Local Machine should be selected as the Store Location. Select [ Next ] to continue.
Select [ Browse ], find and select the CA certificate file (Ca.pem), then select [ Next ].
Leave the default option selected to place all certificates in the Trusted Root Certificate Authorities certificate store, and select [ Next ].
Review the summary of the selected options, and select [ Finish ].
Perform the following steps to associate the certificates with their corresponding private keys stored on the HSM by using certutil:
Note the serial numbers of both the CA certificate and the leaf certificate for use in the following certutil commands. To do so, double-click on each certificate, go to the Details tab, and note down the listed serial number value.
Open Windows PowerShell or Command Prompt as an administrator.
Run the following command to associate the leaf certificate with its corresponding private key stored on the HSM:
Be sure to substitute "serial_number" with the actual certificate serial number value.
My represents the Personal certificate store.
Run the following command to associate the CA certificate with its corresponding private key stored on the :
Root represents the Trusted Root Certification Authorities certificate store.
For further confirmation that both certificates are now associated with their corresponding private keys on the , double-click each certificate in the MMC Certificates snap-in, and you should see a message saying: You have a private key that corresponds to this certificate.