Import Secure Channel certificates on a gateway host using the MMC

This is a procedure for installing Secure Channel certificates on the gateway host computer using the Windows Microsoft Management Console (MMC).

To install the Secure Channel certificates on the gateway host computer, have the following available:

• a certificate authority (CA) file, with private key (PFX) or without (CER)

• the password for the CA and certificate private key

• a gateway certificate with private key (PFX) file

• one or more client certificate files, with private key (PFX) or without (CER)

• the Microsoft Management Console (MMC) open and configured properly

The steps below refer to importing (in bold) certificates to Windows certificate stores, and exporting (in bold) certificate files to a folder. See Import Secure Channel certificates with the MMC and Exporting Secure Channel certificates from the Microsoft Management Console for detailed steps on how to perform these tasks.

Tip: You use a CER file to import a CA or certificate without a private key. If you don't have a CER file, you can import a CA or certificate using a PFX file, then export a CER file that can be imported. This is done to avoid overuse of the private key. The SecureChannelCertificateInstaller.ps1 PowerShell script handles this task automatically.

Tip: When importing a certificate with a private key from a PFX file, a CA without the private key will also be installed in the same certificate store. This file is unnecessary and may be removed (right-click, Delete), but removal isn't necessary either. The SecureChannelCertificateInstaller.ps1 PowerShell script handles this task automatically.

Installation steps, all using the MMC:

1. Import the CA without the private key from a CER file to the Console Root > Certificates (Local Computer) > Trusted Root Certification Authorities store. You can import a CA with the private key from a PFX file, or create a CER file from a PFX file (see tips above).

2. Import only one gateway certificate with private key from a PFX file to the Console Root > Certificates (Local Computer) > Personal store.

3. Import one or more client certificates without the private key from CER files to the Console Root > Certificates (Local Computer) > Trusted People store. You can import a certificate with the private key from a PFX file, or create a CER file from a PFX file (see tips above).