How do I create a CSR and import a third-party SSL certificate for MDaemon or Security Gateway using Certreq?

Windows has a command line utility, certreq.exe that will allow you to create a certificate request and import the new certificate into the Windows Certificate Store, where it can be used with MDaemon or Security Gateway.

MDaemon does not have a method of creating a Certificate Signing Request (CSR) for you in order to obtain a third party SSL certificate issued by a Trusted Root Authority (such as Verisign or GoDaddy).  

The example below will generate a CSR for a 2048 bit key length certificate.

1. Purchase an SSL Certificate from an issuing authority.
2. Create the Certificate Signing Request (CSR): 
   • Log into your mail server using an Administrator account.
   • Create a file named CSRParameters.inf a directory in which the user has  permissions to read/write/interact with.  C:\ is used in this example.

   • Use the contents below as a template, replacing the Subject= section with the server name/location. 

     [NewRequest]
     Subject="CN=mail.company.test,OU=MDaemon Technologies,O=MDaemon Technologies,S=Texas,L=Grapevine,C=US"
     KeySpec=1
     KeyLength=2048
     Exportable=TRUE
     MachineKeySet=TRUE
     SMIME=False
     PrivateKeyArchive=FALSE
     UserProtected=FALSE
     UseExistingKeySet=FALSE
     ProviderName="Microsoft RSA SChannel Cryptographic Provider"
     ProviderType=12
     RequestType=PKCS10
     KeyUsage=0xa0
     Silent=TRUE
     [EnhancedKeyUsageExtension]
     OID=1.3.6.1.5.5.7.3.1 

   • Open a command prompt.
   • Change the directory to a directory in which the command prompt can read/write/interact with.  C:\ is used in this example.
   • Type in the following command:
     

     C:\>certreq -new CSRParameters.inf CSROutput.pem 

   • Open Windows Explorer and browse to the C:\ directory to locate the CSROutput.pem file.
   • Using the CSROutput.pem file, go back to the certificate authority and use the file to request your certificate.
3. Install the certificate:
   • Download the certificate as a CRT file
     • If the certificate authority asks which type of server to select, choose Apache.
   • On the server, open a command prompt.
   • Navigate to the directory that contains the CRT file (C:\ in this example).
   • Enter the following command (substitute mail.example.com.crt for the actual name of the .crt file you received from the certificate authority):
     

     C:\>certreq -accept mail.example.com.crt

4. The certificate will now be available in MDaemon when SSL/HTTP configurations have been created.