Certificate Signing Request
3 min
Complete the following steps to generate the certificate
Manual Process Steps (Client Process Steps)
To complete a Certificate Signing Request, do the following:
- Download OpenSSL Light for Windows at: http://slproweb.com/products/Win32OpenSSL.html. NOTE: Mac users can open Terminal and jump to the OpenSSL commands in Step 5.
- To install OpenSSL, follow the instructions in the Install Wizard.
- Open cmd.exe.
- Go to the location where you installed OpenSSL and at the command line, type: cd C:\Program Files (x86)\OpenSSL-Win32\bin (or C:\Program Files\OpenSSL-Win64\bin for 64-bit).
- Generate the CSR:
- openssl genrsa -out companyname_auth.key 2048
- openssl req -new -key companyname_auth.key -out companyname_auth.csr
Your CSR must not request S/MIME capabilities.
- Enter the following information into your CSR. Leave the Country Name, State or Province Name, Locality Name, and Challenge Password fields blank.
- Organization Name: This MUST be the same string used by your organization when registered with ADP
- Common Name: This is the company name. Please include “MutualSSL” after the company name. Do not use any special characters. Example: ABCCompanyMutualSSL
- After you have created your CSR, follow these steps to submit your request directly to ADP Security Services:
- Open the ADP Certificate Signing Tool (no login is required).
- Choose Authentication and Transaction Signing for the certificate type.
- Enter your technical contact’s email.
- Enter your company name and ADP client ID. NOTE: If you are an ADP Workforce Now client, your ADP client ID is all the characters to the right of the @ symbol in your ADP Workforce Now login name. If you don't know your ADP client ID, contact your ADP representative.
- Enter your technical contact’s first and last name and a group distribution email to be notified when the generated certificate is reaching its two-year expiration date.
- Paste the complete contents (including BEGIN CERTIFICATE REQUEST and END CERTIFICATE REQUEST) of your CSR into the CSR text box.
- Save the signed certificate from ADP into a file named companyname_auth.pem in the same location that you initially created the CSR (C:\Program Files (x86)\OpenSSL-Win32\bin).
- If you are using Windows/IIS, use the following command to get the key and certificate in PKCS12 format:
openssl pkcs12 -export -out "c:\cert_path\companyname_auth.pfx" -name "Company Name Mutual SSL" -inkey "c:\cert_path\companyname_auth.key" -in "c:\cert_path\companyname_auth.pem"- Enter the Export Password.
- Verify the Export Password.
The resulting PFX formatted certificate file will be found in the c:\cert_path folder; companyname_auth.pfx is the file you'll reference for Mutual SSL authentication in the Windows/IIS configuration.
Make sure you safeguard the .key, .pfx, and .jks files. Anyone that possesses these confidential files has access to the web service.