To be honest we could not figure out how to get the cert into the ADAM
service personal certificate store. We use a Windows Enterprise CA and could
only see how to request a cert for the Local Computer. Your message has
prompted
me to re-visit this and the following works for me:
--
Installing a certificate for ADAM SSL
Using a Windows Enterprise Certificate Authority:
Synopsis:
On the (domain) computer running the ADAM instance create an
MMC console that has the Local Computer Personal Certificate
store and the ADAM instance Personal Certificate Store visible.
Request a new certificate in the Local Computer Personal Certificate
Store from the Enterprise Certificate Authority and then move it into
the ADAM instance Personal Certificate store.
HowTo:
On the (member) server that is running the ADAM instance:
Click Start, click Run, type mmc and click OK
In the mmc console
Click File, Click Add/Remove Snap-in, on the Add/Remove Snap-in
popup click Add and then from the Add Standalone Snap-in select
Certificates and Click Add.
On the Certificates Snap-in, Check Computer Account, Click Next
on the Select Computer popup Check Local Computer and click Finish.
From the Add Standalone Snap-in select Certificates and Click Add.
On the Certificates Snap-in Check Service Account, Click Next
on the Select Computer popup Check Local Computer and Next, Select
the ADAM instance service account (default name instance1) from the
list box, Click Finish.
On the Add Standalone Sanp-in poup Click Close
On the Add/Remove Snap-in pop Click OK
The mmc should now contain consoles for
+ Certificates (Local Computer)
+ Certificates - Service (instance1) on Local Computer
Expand both of these consoles.
Under Certificates (Local Computer) Right-Click Personal,
Select All Tasks and then Click Request New Certificate.
On the New Certificate wizard click Next,
On the Certificate Types popup Select Computer under Certificate
types and click Next
(Optionally) Provide a Certificate Friendly name and description
and Click Next.
Click Finish to Close the New Certificate wizard.
If all is well a popup informs you "The certificate request was successful."
Click OK.
Click the Certificates folder that now appears as
Certificates (Local Computer)
Personal
Certificates
in the left-hand pane the new server certificate should be visible.
Right-Click the certificate and Select cut.
Under Certificates - Service (instance1) on Local Computer
Select the <Service name>\Personal folder (ADAM_instance1\Personal by
default).
In the left-hand pane Right-Click and Select Paste.
This should result in the move of the new certificate into the ADAM instance
Personal Store.
--
If there's a better way please let me know and I will merge the info back
with
the other steps as a FAQ on this. For third-party certs I assume it's just
an import
under the ADAM Personal store ( I think there's a KB for LDAP/SSL for
third-party
as well).
Lee Flight
Post by Dmitri Gavrilov [MSFT]Very good description Lee, thanks. One suggestion. You will be safer if on
step (2) you install the cert into "ADAM service personal store" rather than
computer store. That's where ADAM checks first. Computer store could have
other certs, and there's no way to tell which one will be picked.