So now that we have our IPsec certificate for IKEv2,
let's move on to the certificate request for our public TLS certificate.
This is going to be a little bit different because we're going to
actually prepare the request as an offline request.
So we're going to generate a CSR, or certificate signing request,
which is a file that contains the public key and some additional information,
and we're going to send that to our public CA.
I will use DigiCert because that's my public CA of choice.
You can use any public CA you wish.
Fundamentally the process is the same.
The certificate signing request is sent to the public CA,
they'll sign it, and return it,
and then you'll pair that up with your private key,
and then it will be available on this specific server.
So let's go ahead and right‑click anywhere,
again, in the white space here and choose All Tasks,
Advanced Operations, Create Custom Request.
So we'll choose Next,
and here we want to select Proceed without enrollment policy and choose Next.
All of the defaults here are just fine.
We're going to use CNG key.
We'll use PKCS #10 as the request format.
So we'll choose Next.
And here,
we need to select the little arrow here next to
Details and then click Properties.
And this is where we're going to provide all of the
essential information for this request.
So, in this case, the Friendly name, I'm just going to use the same name,
and then we'll click on Subject name.
And once again, in the Subject name field,
we'll choose Common name and put our public FQDN in there and choose Add.
Same thing here, we're going to choose DNS,
paste our public name, and click Add again.
And now we're going to go to the Extensions tab,
and there's a couple of different things that we need to address here.
Specifically, let's expand the Enhanced Key Usage section,
and here we want to choose Server Authentication and click Add.
That's the only EKU that we need.
And then next we want to go to the Private Key tab,
and the CSP here, by default, is RSA.
Now, this will of course work,
but the recommendation is to use a certificate using EC,
or elliptic curve.
So I'm going to uncheck RSA,
but if you're using a public CA that doesn't support EC certificates,
you could just simply leave this as RSA.
But I'm going to uncheck this,
and I'm going to scroll down almost all the way to the bottom here,
and I'm looking for ECDSA_P256,Microsoft Software Key Storage Provider,
that's the CSP that I want to use.
This is the CSP that you'll use for security best practices.
So there's a variety of reasons why you would want to use EC certificates.
They provide better security, better performance with smaller key sizes,
the key is only 256‑bits,
but it provides the equivalent protection of a 3072‑bit RSA key.
So much better protection than RSA with much smaller key sizes,
which is a huge win.
The next thing we'll need to do is go to our Key options.
And if you're building just a single server,
you might not want to check this option,
which is to mark the key as exportable; however,
it may not be a bad idea because if you do this,
even with a single server deployment,
you can then export the certificate along with its
private key and archive that somewhere, safely,
not on a file share.
Hopefully on a secure USB drive, encrypted.
If you have something in the enterprise to store secrets,
then that's a good place to do that as well.
And that way, if you need to rebuild the server,
you don't have to go through this whole process again.
If the certificate's still valid,
you could just grab the certificate and private key and import it.
So I'm going to make it exportable.
You might want to make it exportable as well if you have
multiple servers because then you can do one CSR,
one certificate request, get the certificate back,
and then just put that certificate on all of your VPN servers.
So then click OK, and then click Next, and it's going to ask you the format,
specifically is Base 64, that's the best format to use.
Binary is probably not going to be accepted by many public CAs.
So we use Base 64, and then we need to provide a file name.
So I'm just going to put this on the desktop,
and we'll just call this our vpn_cert_request.
So we'll click finish, and let's go take a look at it on the desktop.
So again, this is just a text file, and if we were to open it,
you'll see that it just has some text here.
Not really meaningful to us.
But if you want to make sure that everything was configured correctly,
there is a way to actually look at it and see human‑readable output.
So to do that, let's open an elevated PowerShell or command window,
navigate to the folder where that certificate is stored,
in this case it's the Desktop,
and then just type in certutil and the name of the file.
And there you go.
You'll see all of your information that you input along with
the details about the certificate and the key length and the
key type and all that good stuff,
but if you want to review this before you submit it,
you can certainly do that.
So once that's done,
you'll take this certificate request file and submit that to your public CA,
and I'm obviously going to do that off‑screen because it's
going to be different for every public CA,
but at the end of the day,
you'll get a certificate back along with probably some
issuing or intermediate certificates,
and we'll go through the process of importing those, next.