Set up the Microsoft Management Console for Secure Channel

This is a procedure for setting up the Microsoft Management Console (MMC) for Secure Channel certificate management.

The Microsoft Management Console (MMC) is a native Windows application. To open and configure it for performing Secure Channel certificate tasks, follow these steps.

1. Open the Microsoft Management Console (MMC) by running mmc in the Run dialog. (You can open the Run dialog by using Windows + R keys.):

   

2. A Windows User Account Control dialog will open. Select Yes to continue. This will open the Microsoft Management Console (MMC):

   

3. In the MMC, choose File > Add/Remove Snap In …. The Add or Remove Snap-ins dialog will open:

   

4. Click to select Certificates in the Available Snap-ins panel, then click Add to add Certificates to the Selected snap-ins pane.

5. In the next dialog choose Computer account, then Next >:

   

6. In the next dialog choose Local computer: ..., then Finish.

   

7. Repeat step 4, choosing My user account, then Finish.

8. The Add or Remove Snap-ins dialog should look like this:

   

9. Click Okay to go back to the MMC. It should look like this. Both Certificates folders can be opened in the left-hand pane to see the individual certificate stores.

   

10. The certificate snap-ins can be double-clicked, or the arrow to the side of the icon can be clicked, to see the various certificate stores.

    Tip: When you close the MMC, you will be prompted to save the console settings. If you do this, you can restore the settings such as added snap-ins, by selecting File > Open and selecting the MSC file that you have saved. (The default file name is Console1.msc.)

    Tip: The result of adding or removing certificates from the various stores doesn't always show up without refreshing the display of the contents of the stores. The individual stores or the entire snap-in can be refreshed to show the new contents by right-clicking and choosing Refresh from the context menu.

The certificate stores organized in the MMC, appearing like a folder and file structure, even though certificates are not files that can be found by browsing the computer. See below for an example:

When looking at a certificate in a store in the MMC, an icon beside the certificate name will show whether or not the certificate includes the private key.

• Certificates with the private key will have an icon showing a key, like this: . Gateway certificates on the gateway host computer and client certificates on the appropriate client computer have the private key. CA certificates created by the SecureChannelCertificateInstaller.ps1script have the private key, but CA certificates created by your company may not. (A CA certificate with a private key can be used to create new signed certificates, which isn't necessary if you are not creating the certificates yourself.)

• Certificates without the private key will have an icon without a key, like this: . Gateway certificates on client computers and client certificates on gateway host computers do not have the private key. CA certificates not created by the SecureChannelCertificateInstaller.ps1script do not need the private key. Certificates that do not need the private key should not have it for security purposes.