How do I generate an SSL Certificate with Microsoft Certificate Services and then install / configure it to work with Apache?

Question

I've generated a certificate request, submitted it to the Microsoft Certificate Services program. It issues the certificate. I downloaded it to conf/ssl/server.cert

I configured it in apache to using

SSLCertificateFile conf/ssl/server.cert
SSLCertificateKeyFile conf/ssl/server.key

When I start the server with this config I get

Secure Connection Failed An error occurred during a connection to 192.168.1.100.

Certificate type not approved for application. (Error code: sec_error_inadequate_cert_type) The page you are trying to view can not be shown because the authenticity of the received data could not be verified.

• Please contact the web site owners to inform them of this problem.

If I download the CA Certificate and install it with

SSLCertificateFile conf/ssl/server.crt
SSLCertificateKeyFile conf/ssl/server.key
SSLCACertificateFile conf/ssl/cacert.crt

The server fails to start.

It works fine if I generate a self signed certificate an install it, but I need it to come from Microsoft Certificate Services so it won't warn internal users about the certificate.

Answer 1

Sounds like your cert isn't allowed to be used for a server. IIRC, you can view the certificate in a browser and look for Usage or some such language, and it should say SSL Server (possibly among other things).

Answer 2

You need to make sure that the issued certificate has "Server Authentication" specified as one of the permitted uses in the extended key usage extension. The easiest way to do this (and only way on Win2k3 Standard) is to use the Web Server certificate template.

You need to use the Certificate Services MMC snap-in to add this certificate template to the list of those allowed, and then need to configure permissions so the appropriate user(s) can request certificates.