So, I've completed my certificate submission to DigiCert.
I went through the entire process of ordering the certificate, proving I
own the domain, paying for the certificate, and so forth.
And they've approved my certificate request, signed it, and sent it back to me.
So in this case, they returned two certificates. There's a DigiCertCA
certificate, which is an intermediate CA certificate or a subordinate CA
certificate, as well as my end entity certificate or the certificate that
I actually requested them to sign.
So before we import this certificate, we will need to
import the issuing CA certificate.
So once again, we'll go back to the Local Computer certificate
store. And here I want to expand Intermediate Certification
Authorities and then highlight Certificates.
And then here I'm just going to right‑click, choose All Tasks,
Import, choose Next.
And I'm going to specify the name of that intermediate CA file. So click OK,
and Next, and then Next again and Finish, and then click OK.
And now we'll see our intermediate certificate in the store. And at this
point, we're ready to import the certificate that we got back, the actual
end entity certificate that we requested.
So once again, we'll right‑click All Tasks, Import,
choose Next,
choose Browse, and we'll select our end entity certificate.
Click Next, and Personal store is fine, so we'll choose Next
and Finish, and then click OK.
And now you'll see that we have a second certificate
in the store issued by GeoTrust,
which in this case is my DigiCert CA. So let's double‑click on that.
And the first thing you'll notice here is that I have a private
key that corresponds to this certificate.
Fantastic, so let's click OK.
And at this point,
if I wanted to archive this certificate or I had multiple
servers and I wanted to export it, then I would just simply
right‑click, choose All Tasks, Export, Next.
Yes,
export the private key because I stipulated as a part of my
request that I wanted to make the key exportable.
If you do not see this option,
it means that you missed that step, and you might have
to go back and repeat this process.
So I'm going to choose Next, and then we'll select PKCS #12,
which is .PFX file format.
You can choose to include all certificates.
This would mean the root and intermediate CA certificates as well.
So we'll choose Next, and we'll supply a super secret password for this file.
And I typically leave the Encryption set to TripleDES‑SHA1.
It may sound counterintuitive from a security perspective,
but this gives you the most compatibility.
It means you could install it on a number of different servers
without having to worry about compatibility.
However, if you're installing this on, you know,
all Windows Server 2022 servers, you most certainly could choose AES256.
I usually leave it set here, again, for backwards compatibility.
So I'll choose Next, and we'll save this out to the
desktop. And we'll click through and click OK.
And at that point, this certificate is now a PFX file, so it's a PKCS #12 format,
so it has the certificate along with the public key and the private key.
I could use this to install on additional VPN servers or importantly,
I could archive this again securely and safely and make sure that it's
there in the event of a disaster recovery scenario,
I need to rebuild the server, I don't have to go through
this whole process again. I can just simply bring the certificate back and import it.