Jul 27, 2020

Generate ECC CSR Windows Server 2008+

Introduction

Microsoft added support for ECC (Elliptic Curve Cryptography) starting with Windows Server 2008. While the support is present in Server 2008 - Server 2012 R2, the default CSP (Cryptographic Service Provider) is set to generate RSA keys. In order to generate an ECC key, the CSP must be manually specified. This can be accomplished with a CSR request through the MMC. 
 

Instructions

1.  Go to Start > Run > mmc. Press Enter:



2. In the MMC, go to File > Add / Remove Snap-In...


3. Choose the Certificates snap-in. Click Add.


4. Choose Computer Account. Click Next >


5. Choose Local Computer. Click Finish.


6. Click OK to exit the snap-in window.


7. In the MMC window, expand the following sections: Certificates (Local Computer) > Personal > Certificates


8. Right-click the Certificates folder and go to All Tasks > Advanced Operations > Create Custom Request...


9. Click Next on the Certificate Enrollment window. 


10. Choose Proceed without enrollment policy. Click Next.


11. Choose CNG Key and the PKCS#10 options. (These should be default).


12. Expand the Details section of the custom request and click Properties


13. On the General tab, fill out a Friendly name and Description. These options are for certificate identification in places like IIS & Exchange. This information does not get vetted or appear on the certificate itself. 


14. On the Subject tab you can specify various fields to appear in your CSR. Select the field you wish to populate from the drop-down menu, enter a value, and click Add.


15. Repeat this for each additional field you wish to specify. At minimum for a Domain Validated certificate, you should have Common Name and Country specified. 


16. Skip to the Private Key tab and expand the Cryptographic Service Provider section. 

Uncheck the first box for RSA, Microsoft Software Key Storage Provider. 

Choose one of the ECDSA boxes for an ECC provider. In this instance, the P256 curve is chosen (most common).

 


17. Next expand the Key Options section. Here you can mark the key as exportable. 

Click Apply. Click OK.



18. Click Next to continue the Certificate Enrollment process. 


19. Choose the Base 64 option and click Browse to choose a location for your CSR:


20. Name your request and press Save


21. Click Finish to complete your request.