Import Secure Channel certificates on a client computer using the MMC

This is a procedure for installing Secure Channel certificates on the gateway host computer using the Windows Microsoft Management Console (MMC).

To import the Secure Channel certificates on a client computer, have the following available:

• a certificate authority (CA) file, with private key (PFX) or without (CER)

• the password for the CA and certificate private key

• a client certificate with private key (PFX) file

• one or more gateway certificate files, with private key (PFX) or without (CER)

• the Microsoft Management Console (MMC) open and configured properly

The steps below refer to importing (in bold) certificates to Windows certificate stores, and exporting (in bold) certificate files to a folder. See Import Secure Channel certificates with the MMC and Exporting Secure Channel certificates from the Microsoft Management Console for detailed steps on how to perform these tasks.

Tip: You use a CER file to import a CA or certificate without a private key. If you don't have a CER file, you can import a CA or certificate using a PFX file, then export a CER file that can be imported. This is done to avoid overuse of the private key. The SecureChannelCertificateInstaller.ps1 PowerShell script handles this task automatically.

Tip: When importing a certificate with a private key from a PFX file, a CA without the private key will also be installed in the same certificate store. This file is unnecessary and may be removed (right-click, Delete), but removal isn't necessary either. The SecureChannelCertificateInstaller.ps1 PowerShell script handles this task automatically.

Installation steps, all using the MMC:

1. Import the CA without the private key from a CER file to the Console Root > Certificates - Current User > Trusted Root Certification Authorities store. You can import a CA with the private key from a PFX file, or create a CER file from a PFX file (see tips above).

   Tip: If the CA is already installed to the Console Root > Certificates (Local Computer) > Trusted Root Certification Authorities store, there is no necessity to also install it to the Console Root > Certificates - Current User > Trusted Root Certification Authorities store. This may occur if the gateway host and the client computer are the same computer.

2. Import only one client certificate with private key from a PFX file to the Console Root > Certificates - Current User > Personal store.

3. Import one or more gateway certificates without the private key from CER files to the Console Root > Certificates - Current User > Trusted People store. You can import a certificate with the private key from a PFX file, or create a CER file from a PFX file (see tips above).