Active Directory requires a server certificate to secure communications to the directory over LDAPS. The following procedure describes how to to create a certificate signing request (CSR) an Active Directory server certificate. A CSR contains information that the issuing CA will use to create the certificate. Entrust PKI as a Service or an on-premises CA can process the CSR and issue the certificate.

To create a CSR for an Active Directory server certificate

  1. Log into Active Directory as a member of the Domain Admins group.
  2. Run mmc.exe (Select Start > Windows System > Run, then enter mmc.exe).
    The Microsoft Management Console appears. 
  3. Select File > Add/Remove Snap-in.
    The Add or Remove Snap-ins dialog box appears.
  4. In the Available snap-ins list, select Certificates.
  5. Click Add.
    The Certificates snap-in dialog box appears.
  6. Select Service account.
  7. Click Next.
    The Select Computer dialog box appears.
  8. Select Local computer.
  9. Click Next.
    The Certificates snap-in dialog box reappears.
  10. Select Active Directory Domain Services.
  11. Click Finish.
    The Certificates snap-in as added to the list of Selected snap-ins.
  12. Click OK.
    The Certificates snap-in appears in the Microsoft Management Console.
  13. In the tree view, select Certificates > NTDS\Personal.
  14. Select Action > All Tasks > Advanced Operations > Create Custom Request.
    The Certificate Enrollment wizard appears.
  15. Click Next.
    The Select Certificate Enrollment Policy page appears.
  16. Under Configured by your administrator, select Active Directory Enrollment Policy.
  17. Click Next.
    The Custom request page appears.
  18. In the Template drop-down list, select (No template) CNG key.
  19. For Request format, select PKCS #10.
  20. Click Next.
    The Certificate Information page appears.
  21. Click Next.
    The Where do you want to save the offline request? page appears.
  22. In the File Name field, enter the path and file name for the CSR, or click Browse to select a location.
  23. For File format, select Base 64.
  24. Click OK.