hmLoadTopic({
hmKeywords:"using custom certificates,windows PKI",
hmTitle:"Custom certificates with ESET PROTECT On-Prem",
hmDescription:"If you have your own PKI (public key infrastructure) and want ESET PROTECT On-Prem to use your custom certificates for communication between components, see the example below....",
hmPrevLink:"set_new_era_server_certificate.html",
hmNextLink:"use_custom_certificates.html",
hmParentLink:"admin_cert_peers.html",
hmBreadCrumbs:"<a href=\"using.html\">Using ESET PROTECT On-Prem<\/a> &gt; <a href=\"working_with_era.html\">ESET PROTECT On-Prem Main Menu<\/a> &gt; More &gt; <a href=\"admin_certificates.html\">Certificates<\/a> &gt; <a href=\"admin_cert_peers.html\">Peer Certificates<\/a>",
hmTitlePath:"Using ESET PROTECT On-Prem > ESET PROTECT On-Prem Main Menu > More > Certificates > Peer Certificates > Custom certificates with ESET PROTECT On-Prem",
hmHeader:"<h1 class=\"p_Heading1\"><span class=\"f_Heading1\">Custom certificates with ESET PROTECT On-Prem<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_Normal\">If you have your own PKI (public key infrastructure) and want ESET PROTECT On-Prem to use your custom certificates for communication between components, see the example below. This example is performed on Windows Server 2025. Screen shots may vary on other versions of Windows, however the general procedure is unchanged.<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_warning\" >\n\r<tr class=\"Table_warning\">\n\r<td class=\"Table_warning\" style=\"width:4px; background-color:#E04239;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_warning\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Warning\" title=\"Warning\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/warning.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_warning\"><p class=\"p_Normal\">Do not use certificates with a short validity (for example, Let\'s Encrypt that are valid for 90 days) to avoid the complex procedure of their frequent replacement.<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_note\" >\n\r<tr class=\"Table_note\">\n\r<td class=\"Table_note\" style=\"width:4px; background-color:#3DAAE1;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_note\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Note\" title=\"Note\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/note.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_note\"><p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 13px; margin-left: 0;\"><span class=\"f_Normal\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span>You can use OpenSSL to create new self-signed certificates. For more information, see our <a href=\"https:\/\/support.eset.com\/kb8274\" target=\"_blank\" onclick=\"return HMTrackTopiclink(this);\" class=\"weblink\">Knowledgebase article<\/a>.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 13px; margin-left: 0;\"><span class=\"f_Normal\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span>For step-by-step instructions to use custom certificates in ESET PROTECT On-Prem, <a href=\"use_custom_certificates.html\" class=\"topiclink\">see the next chapter<\/a>.<\/p><\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\">Required server roles:<\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_NormalList\">Active Directory Domain Services.<\/span><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 32px; margin-left: 0;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span>Active Directory Certificate Services with the Standalone Root CA installed.<\/p>\n\r<p class=\"p_Normal\">Follow the steps below to create a custom certificate:<\/p>\n\r<p class=\"p_NormalList\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalList\"><a href=\"custom_certificates.html#1\" class=\"topiclink hmlinklistitem\">1. Open Management Console and add the Certificates Snap-in<\/a><\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalList\"><a href=\"custom_certificates.html#2\" class=\"topiclink hmlinklistitem\">2. Create a Custom Certificate Request<\/a><\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalList\"><a href=\"custom_certificates.html#3\" class=\"topiclink hmlinklistitem\">3. Import your custom certificate request<\/a><\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalList\"><a href=\"custom_certificates.html#4\" class=\"topiclink hmlinklistitem\">4. Export Issued Custom Certificate to a .tmp file<\/a><\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalList\"><a href=\"custom_certificates.html#5\" class=\"topiclink hmlinklistitem\">5. Import the .tmp file<\/a><\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalList\"><a href=\"custom_certificates.html#6\" class=\"topiclink hmlinklistitem\">6. Export the Certificate including a private key to a .pfx file<\/a><\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalList\"><a href=\"custom_certificates.html#7\" class=\"topiclink hmlinklistitem\">7. Export Certification Authority<\/a><\/span><\/p>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><a id=\"1\" class=\"hmanchor\"><\/a><span class=\"f_Heading2\">1. Open Management Console and add the Certificates Snap-in<\/span><\/h2>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">1.<\/span>Log on to the server as a member of the local Administrator group.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">2.<\/span>Run mmc.exe to open Management Console.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">3.<\/span>Click <span class=\"f_UI\">File<\/span> and select <span class=\"f_UI\">Add\/Remove Snap-in<\/span> (or press <span class=\"f_UI\">CTRL+M<\/span>).<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">4.<\/span>Select <span class=\"f_UI\">Certificates<\/span> in the left pane and click <span class=\"f_UI\">Add<\/span>.<\/p>\n\r<p class=\"p_Normal\"><img alt=\"Add a certificate.\" title=\"Add a certificate.\" width=\"786\" height=\"546\" style=\"margin:0;width:786px;height:546px;border:none\" src=\".\/images\/using_custom_certificate_01.png\"\/><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">5.<\/span>Select <span class=\"f_UI\">Computer Account<\/span> and click <span class=\"f_UI\">Next<\/span>.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">6.<\/span>Ensure <span class=\"f_UI\">Local Computer<\/span> is selected (default) and click <span class=\"f_UI\">Finish<\/span>.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">7.<\/span>Click <span class=\"f_UI\">OK<\/span>.<\/p>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><a id=\"2\" class=\"hmanchor\"><\/a><span class=\"f_Heading2\">2. Create a Custom Certificate Request<\/span><\/h2>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">1.<\/span>Double-click <span class=\"f_UI\">Certificates (Local Computer)<\/span> to expand it.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">2.<\/span>Right-click <span class=\"f_UI\">Personal<\/span> and select <span class=\"f_UI\">All Tasks<\/span> &gt; <span class=\"f_UI\">Advanced Operations<\/span> and choose <span class=\"f_UI\">Create Custom Request<\/span>.<\/p>\n\r<p class=\"p_Normal\"><img alt=\"Create a custom certificate request.\" title=\"Create a custom certificate request.\" width=\"822\" height=\"467\" style=\"margin:0;width:822px;height:467px;border:none\" src=\".\/images\/using_custom_certificate_02.png\"\/><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">3.<\/span>The Certificate Enrollment wizard window will open, click <span class=\"f_UI\">Next<\/span>.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">4.<\/span>Select <span class=\"f_UI\">Proceed without enrollment policy<\/span> and click <span class=\"f_UI\">Next<\/span> to continue.<\/p>\n\r<p class=\"p_Normal\"><img alt=\"Proceed without enrollment policy.\" title=\"Proceed without enrollment policy.\" width=\"629\" height=\"461\" style=\"margin:0;width:629px;height:461px;border:none\" src=\".\/images\/using_custom_certificate_03.png\"\/><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">5.<\/span>Choose <span class=\"f_UI\">(No template) CNG key<\/span> from the drop-down list and ensure that the <span class=\"f_UI\">PKCS #10<\/span> Request format is selected. Click <span class=\"f_UI\">Next<\/span>.<\/p>\n\r<p class=\"p_Normal\"><img alt=\"(No template) CNG key\" title=\"(No template) CNG key\" width=\"629\" height=\"461\" style=\"margin:0;width:629px;height:461px;border:none\" src=\".\/images\/using_custom_certificate_04.png\"\/><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">6.<\/span>Click the arrow to expand the <span class=\"f_UI\">Details<\/span> section and then click <span class=\"f_UI\">Properties<\/span>.<\/p>\n\r<p class=\"p_Normal\"><img alt=\"Expand the Details and click Properties.\" title=\"Expand the Details and click Properties.\" width=\"629\" height=\"461\" style=\"margin:0;width:629px;height:461px;border:none\" src=\".\/images\/using_custom_certificate_05.png\"\/><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">7.<\/span>In the <span class=\"f_UI\">General<\/span> tab, type in a <span class=\"f_UI\">Friendly name<\/span> for your certificate, you can also type a <span class=\"f_UI\">Description<\/span> (optional).<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">8.<\/span>In the <span class=\"f_UI\">Subject<\/span> tab, in <span class=\"f_UI\">Subject name<\/span> section, select <span class=\"f_UI\">Common Name<\/span> from the drop-down list under <span class=\"f_UI\">Type<\/span>, type <span class=\"f_CodeHighlighted\">server<\/span> in the <span class=\"f_UI\">Value<\/span> field and then click <span class=\"f_UI\">Add<\/span>. <span class=\"f_UI\">CN=server<\/span> will appear in the information box on the side. If you are creating a certificate request for ESET Management Agent type <span class=\"f_CodeHighlighted\">agent<\/span> in the <span class=\"f_UI\">Common name<\/span> value field.<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_important\" >\n\r<tr class=\"Table_important\">\n\r<td class=\"Table_important\" style=\"width:4px; background-color:#E9A514;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_important\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Important\" title=\"Important\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/important.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_important\"><p class=\"p_Normal\">The Common Name must contain one of these strings: <span class=\"f_CodeHighlighted\">server<\/span> or <span class=\"f_CodeHighlighted\">agent<\/span>, depending on which Certificate Request you want to create.<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">9.<\/span>In the <span class=\"f_UI\">Alternative name<\/span> section, choose <span class=\"f_UI\">DNS<\/span> from the drop-down list under <span class=\"f_UI\">Type<\/span> and type * (asterisk) into the <span class=\"f_UI\">Value<\/span> field, then click the <span class=\"f_UI\">Add<\/span> button.<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_important\" >\n\r<tr class=\"Table_important\">\n\r<td class=\"Table_important\" style=\"width:4px; background-color:#E9A514;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_important\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Important\" title=\"Important\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/important.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_important\"><p class=\"p_Normal\">Subject Alternative Name (SAN) should be defined as &quot;DNS:*&quot; for ESET PROTECT Server and for all the Agents.<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\"><img alt=\"Alternative name\" title=\"Alternative name\" width=\"502\" height=\"507\" style=\"margin:0;width:502px;height:507px;border:none\" src=\".\/images\/using_custom_certificate_06.png\"\/><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">10.<\/span> In the <span class=\"f_UI\">Extensions<\/span> tab, do the following:<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 40px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">a)<\/span>Expand the <span class=\"f_UI\">Key usage<\/span> section by clicking the arrow.<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 13px;\"><table class=\"Table_important\" >\n\r<tr class=\"Table_important\">\n\r<td class=\"Table_important\" style=\"width:4px; background-color:#E9A514;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_important\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Important\" title=\"Important\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/important.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_important\"><p class=\"p_Normal\">Ensure to select and add these 3 options from the <span class=\"f_UI\">Available options<\/span>:<\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_UI\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_UI\">Digital signature<\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_UI\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_UI\">Key agreement<\/span><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 32px; margin-left: 0;\"><span class=\"f_UI\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_UI\">Key encipherment<\/span><\/p>\n\r<p class=\"p_Normal\">Deselect <span class=\"f_UI\">Make these key usages critical<\/span>.<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\"><img alt=\"Key usage\" title=\"Key usage\" width=\"502\" height=\"507\" style=\"margin:0;width:502px;height:507px;border:none\" src=\".\/images\/using_custom_certificate_07.png\"\/><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 40px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">b)<\/span>Expand the <span class=\"f_UI\">Extended Key usage (application policies)<\/span> section by clicking the arrow. Select and add <span class=\"f_UI\">Server Authentication<\/span> for Server certificate or <span class=\"f_UI\">Client Authentication<\/span> for Agent certificate.<\/p>\n\r<p class=\"p_Normal\"><img alt=\"Extended key usage\" title=\"Extended key usage\" width=\"502\" height=\"507\" style=\"margin:0;width:502px;height:507px;border:none\" src=\".\/images\/using_custom_certificate_07_02.png\"\/><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">11.<\/span> In the <span class=\"f_UI\">Private Key<\/span> tab, do the following:<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 40px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">a)<\/span>Expand the <span class=\"f_UI\">Cryptographic Service Provider<\/span> section by clicking the arrow. A list of all cryptographic service providers (CSPs) will be displayed.<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 13px;\"><table class=\"Table_note\" >\n\r<tr class=\"Table_note\">\n\r<td class=\"Table_note\" style=\"width:4px; background-color:#3DAAE1;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_note\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Note\" title=\"Note\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/note.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_note\"><p class=\"p_Normal\">Ensure that only <span class=\"f_UI\">RSA, Microsoft Software Key Storage Provider<\/span> is selected. Deselect all other CSPs.<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 40px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">b)<\/span>Expand the <span class=\"f_UI\">Key<\/span> <span class=\"f_UI\">Options<\/span> section. In the <span class=\"f_UI\">Key size<\/span> menu, set a value of at least <span class=\"f_UI\">2048<\/span>. Select <span class=\"f_UI\">Make private key exportable<\/span>.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 40px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">c)<\/span>Click <span class=\"f_UI\">Apply<\/span> and check your settings.<\/p>\n\r<p class=\"p_Normal\"><img alt=\"Private Key settings\" title=\"Private Key settings\" width=\"502\" height=\"507\" style=\"margin:0;width:502px;height:507px;border:none\" src=\".\/images\/using_custom_certificate_08.png\"\/><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">12.<\/span> Click <span class=\"f_UI\">OK<\/span>. Certificate information will be displayed. Click the <span class=\"f_UI\">Next<\/span> button to continue. Click <span class=\"f_UI\">Browse<\/span> to select the location where the certificate signing request (CSR) will be saved. Type the filename and ensure that <span class=\"f_UI\">Base 64<\/span> is selected.<\/p>\n\r<p class=\"p_Normal\"><img alt=\"Select the location where the certificate signing request will be saved.\" title=\"Select the location where the certificate signing request will be saved.\" width=\"629\" height=\"461\" style=\"margin:0;width:629px;height:461px;border:none\" src=\".\/images\/using_custom_certificate_09.png\"\/><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">13.<\/span> Click <span class=\"f_UI\">Finish<\/span> to generate the CSR.<\/p>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><a id=\"3\" class=\"hmanchor\"><\/a><span class=\"f_Heading2\">3. Import your custom certificate request<\/span><\/h2>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">1.<\/span>Open Server Manager and click <span class=\"f_UI\">Tools<\/span> &gt; <span class=\"f_UI\">Certification Authority<\/span>.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">2.<\/span>In the <span class=\"f_UI\">Certification Authority (Local)<\/span> tree, select <span class=\"f_UI\">Your Server<\/span> (usually FQDN) &gt; <span class=\"f_UI\">Properties<\/span> and then select the <span class=\"f_UI\">Policy Module<\/span> tab. Click <span class=\"f_UI\">Properties<\/span> and select <span class=\"f_UI\">Set the certificate request status to pending. The administrator must explicitly issue the certificate<\/span>. Otherwise, it will not work properly. Click <span class=\"f_UI\">OK<\/span>. You must restart Active Directory certificate services if you need to change this setting.<\/p>\n\r<p class=\"p_Normal\"><img alt=\"Set the certificate request status to pending.\" title=\"Set the certificate request status to pending.\" width=\"400\" height=\"468\" style=\"margin:0;width:400px;height:468px;border:none\" src=\".\/images\/using_custom_certificate_10.png\"\/><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">3.<\/span>In the <span class=\"f_UI\">Certification Authority (Local)<\/span> tree, right-click <span class=\"f_UI\">Your Server (usually FQDN)<\/span> &gt; <span class=\"f_UI\">All Tasks<\/span> &gt; <span class=\"f_UI\">Submit new request<\/span> and navigate to your previously generated <span class=\"f_UI\">CSR<\/span> file from step 2.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">4.<\/span>The certificate will be added under <span class=\"f_UI\">Pending Requests<\/span>. Right-click the <span class=\"f_UI\">CSR<\/span> in the navigation pane and select <span class=\"f_UI\">All Tasks<\/span> &gt; <span class=\"f_UI\">Issue<\/span>.<\/p>\n\r<p class=\"p_Normal\"><img alt=\"Issue a custom certificate.\" title=\"Issue a custom certificate.\" width=\"802\" height=\"458\" style=\"margin:0;width:802px;height:458px;border:none\" src=\".\/images\/using_custom_certificate_11.png\"\/><\/p>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><a id=\"4\" class=\"hmanchor\"><\/a><span class=\"f_Heading2\">4. Export Issued Custom Certificate to a .tmp file<\/span><\/h2>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">1.<\/span>Select <span class=\"f_UI\">Issued<\/span> Certificates in the left pane. Right-click the certificate you want to export and click <span class=\"f_UI\">All Tasks<\/span> &gt; <span class=\"f_UI\">Export Binary Data<\/span>.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">2.<\/span>In the <span class=\"f_UI\">Export Binary Data<\/span> dialog, choose <span class=\"f_UI\">Binary Certificate<\/span> from the drop-down list. In <span class=\"f_UI\">Export options<\/span>, click <span class=\"f_UI\">Save<\/span> <span class=\"f_UI\">binary data to a file<\/span> and then click <span class=\"f_UI\">OK<\/span>.<\/p>\n\r<p class=\"p_Normal\"><img alt=\"Export binary data.\" title=\"Export binary data.\" width=\"334\" height=\"243\" style=\"margin:0;width:334px;height:243px;border:none\" src=\".\/images\/using_custom_certificate_12.png\"\/><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">3.<\/span>In the <span class=\"f_UI\">Save Binary Data<\/span> dialog box, move to the file location where you want to save the certificate and then click <span class=\"f_UI\">Save<\/span>.<\/p>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><a id=\"5\" class=\"hmanchor\"><\/a><span class=\"f_Heading2\">5. Import the .tmp file<\/span><\/h2>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">1.<\/span>Navigate to <span class=\"f_UI\">Certificate (Local Computer)<\/span> &gt; right-click <span class=\"f_UI\">Personal<\/span> and select <span class=\"f_UI\">All Tasks<\/span> &gt; <span class=\"f_UI\">Import<\/span>.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">2.<\/span>Click <span class=\"f_UI\">Next<\/span>.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">3.<\/span>Locate your saved <span class=\"f_Path\">.tmp<\/span> binary file using <span class=\"f_UI\">Browse<\/span> and click <span class=\"f_UI\">Open<\/span>. Select <span class=\"f_UI\">Place all certificates in the following store<\/span> &gt; <span class=\"f_UI\">Personal<\/span>. Click <span class=\"f_UI\">Next<\/span>.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">4.<\/span>Click <span class=\"f_UI\">Finish<\/span> to import the certificate.<\/p>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><a id=\"6\" class=\"hmanchor\"><\/a><span class=\"f_Heading2\">6. Export the Certificate including a private key to a .pfx file<\/span><\/h2>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">1.<\/span>In <span class=\"f_UI\">Certificates (Local Computer)<\/span> expand <span class=\"f_UI\">Personal<\/span> and click <span class=\"f_UI\">Certificates<\/span>, right-click the new certificate that you want to export and select <span class=\"f_UI\">All Tasks<\/span> &gt; <span class=\"f_UI\">Export<\/span>.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">2.<\/span>In the <span class=\"f_UI\">Certificate Export Wizard<\/span>, click <span class=\"f_UI\">Yes, export the private key<\/span>. (This option will appear only if the private key is marked as exportable and you have access to the private key.)<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">3.<\/span>Under <span class=\"f_UI\">Export File Format<\/span>, select <span class=\"f_UI\">Personal Information Exchange -PKCS #12 (.PFX)<\/span>, select the check box next to <span class=\"f_UI\">Include all certificates in the certification path if possible<\/span> and then click <span class=\"f_UI\">Next<\/span>.<\/p>\n\r<p class=\"p_Normal\"><img alt=\"Export file format.\" title=\"Export file format.\" width=\"535\" height=\"523\" style=\"margin:0;width:535px;height:523px;border:none\" src=\".\/images\/using_custom_certificate_13.png\"\/><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">4.<\/span>Select the <span class=\"f_UI\">Password<\/span> check box, type a password to encrypt the private key you are exporting. In the <span class=\"f_UI\">Confirm password<\/span> field, type the same password again and then click <span class=\"f_UI\">Next<\/span>.<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_warning\" >\n\r<tr class=\"Table_warning\">\n\r<td class=\"Table_warning\" style=\"width:4px; background-color:#E04239;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_warning\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Warning\" title=\"Warning\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/warning.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_warning\"><p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 13px; margin-left: 0;\"><span class=\"f_Normal\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span>The certificate passphrase must not contain the following characters: <span class=\"f_CodeHighlighted\">&quot; \\<\/span> These characters cause a critical error during Agent initialization.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 13px; margin-left: 0;\"><span class=\"f_Normal\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span>The password must contain at least 14 characters in three categories: lowercase letters, uppercase letters, digits or special characters. We recommend using a password with no less than 17 characters.<\/p><\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\"><img alt=\"Type a password to encrypt the private key.\" title=\"Type a password to encrypt the private key.\" width=\"535\" height=\"523\" style=\"margin:0;width:535px;height:523px;border:none\" src=\".\/images\/using_custom_certificate_14.png\"\/><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">5.<\/span>In <span class=\"f_UI\">File name<\/span>, type a filename and path for the <span class=\"f_Path\">.pfx<\/span> file that will store the exported certificate and private key. Click <span class=\"f_UI\">Next<\/span> and then click <span class=\"f_UI\">Finish<\/span>.<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_note\" >\n\r<tr class=\"Table_note\">\n\r<td class=\"Table_note\" style=\"width:4px; background-color:#3DAAE1;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_note\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Note\" title=\"Note\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/note.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_note\"><p class=\"p_Normal\">The above example shows you how to create an ESET Management Agent certificate. Repeat the same steps for ESET PROTECT Server certificates.<\/p>\n\r<p class=\"p_Normal\">You cannot use this certificate to <a href=\"certificates_certificate_era.html\" class=\"topiclink\">sign another<\/a> new certificate in the Web Console.<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><a id=\"7\" class=\"hmanchor\"><\/a><span class=\"f_Heading2\">7. Export Certification Authority<\/span><\/h2>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">1.<\/span>Open Server Manager and click <span class=\"f_UI\">Tools<\/span> &gt; <span class=\"f_UI\">Certification Authority<\/span>.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">2.<\/span>In the <span class=\"f_UI\">Certification Authority (Local)<\/span> tree, select the <span class=\"f_UI\">Your Server (usually FQDN)<\/span> &gt; <span class=\"f_UI\">Properties<\/span> &gt; <span class=\"f_UI\">General<\/span> tab and click <span class=\"f_UI\">View Certificate<\/span>.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">3.<\/span>In the <span class=\"f_UI\">Details<\/span> tab, click <span class=\"f_UI\">Copy to File<\/span>. The <span class=\"f_UI\">Certificate Export Wizard<\/span> will open.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">4.<\/span>In the <span class=\"f_UI\">Export File Format<\/span> window, select <span class=\"f_UI\">DER encoded binary X.509 (.CER)<\/span> and click <span class=\"f_UI\">Next<\/span>.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">5.<\/span>Click <span class=\"f_UI\">Browse<\/span> to select the location where the <span class=\"f_Path\">.cer<\/span> file will be saved and then click <span class=\"f_UI\">Next<\/span>.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">6.<\/span>Click <span class=\"f_UI\">Finish<\/span> to export the Certification Authority.<\/p>"
})
