---
title: Certificate Signing Request
slug: guide/certificate-signing-request
docTags: 
createdAt: 2025-10-10T12:13:19.259Z
---

Complete the following steps to generate the certificate

### Manual Process Steps (Client Process Steps)

To complete a Certificate Signing Request, do the following:

1. Download OpenSSL Light for Windows at: [http://slproweb.com/products/Win32OpenSSL.html](http://slproweb.com/products/Win32OpenSSL.html).
   **NOTE**: *Mac users can open Terminal and jump to the OpenSSL commands in Step 5.* 
2. To install OpenSSL, follow the instructions in the Install Wizard.
3. Open **cmd.exe**.
4. Go to the location where you installed OpenSSL and at the command line, type:
   **cd C:\Program Files (x86)\OpenSSL-Win32\bin (*or C:\Program Files\OpenSSL-Win64\bin for 64-bit*)**.
5. Generate the CSR:
   - **openssl genrsa -out companyname\_auth.key 2048**
   - **openssl req -new -key companyname\_auth.key -out companyname\_auth.csr**

:::BlockQuote
Your CSR must not request S/MIME capabilities.
:::

6. Enter the following information into your CSR. Leave the Country Name, State or Province Name, Locality Name, and Challenge Password fields blank.
   - **Organization Name**: This **MUST** be the same string used by your organization when registered with ADP
   - **Common Name**: This is the company name. Please include “MutualSSL” after the company name. Do not use any special characters. Example:  ABCCompanyMutualSSL
7. After you have created your CSR, follow these steps to submit your request directly to ADP Security Services:
   - Open the [ADP Certificate Signing Tool](https://cert-manager.com/customer/adp/device/adpwebservices) (no login is required).
   - Choose **Authentication and Transaction Signing** for the certificate type.
   - Enter your technical contact’s email.
   - Enter your company name and ADP client ID.
     **NOTE:** *If you are an ADP Workforce Now client, your ADP client ID is all the characters to the right of the @ symbol in your ADP Workforce Now login name. If you don't know your ADP client ID, contact your ADP representative.*  
   - Enter your technical contact’s first and last name and a group distribution email to be notified when the generated certificate is reaching its two-year expiration date.
   - Paste the complete contents (including **BEGIN CERTIFICATE REQUEST** and **END CERTIFICATE REQUEST**) of your CSR into the CSR text box.
      
8. Save the signed certificate from ADP into a file named **companyname\_auth.pem** in the same location that you initially created the CSR (**C:\Program Files (x86)\OpenSSL-Win32\bin**).
9. If you are using Windows/IIS, use the following command to get the key and certificate in **PKCS12 format:** 

```shell
​​​​​​​openssl pkcs12 -export -out "c:\cert_path\companyname_auth.pfx" -name "Company Name Mutual SSL" -inkey "c:\cert_path\companyname_auth.key" -in  "c:\cert_path\companyname_auth.pem"
```

1. Enter the **Export Password**.
2. Verify the **Export Password**.

The resulting PFX formatted certificate file will be found in the **c:\cert\_path** folder; **companyname\_auth.pfx** is the file you'll reference for Mutual SSL authentication in the Windows/IIS configuration.

:::BlockQuote
Make sure you safeguard the **.key**, **.pfx**, and **.jks** files. Anyone that possesses these confidential files has access to the web service.
:::