Generating a Certificate Signing Request and Obtaining a Certificate with Microsoft Certreq

To make a certificate available to a Horizon 8 server, you must create a configuration file, generate a certificate signing request (CSR) from the configuration file, and send the signing request to a CA. When the CA returns the certificate, you must import the signed certificate into the Windows local computer certificate store on the Horizon 8 server host, where it joins the previously generated private key.

A CSR can be generated in several ways, depending on how the certificate itself will be generated.

1. Create a CSR Configuration File
   The Microsoft certreq utility uses a configuration file to generate a CSR. You must create a configuration file before you can generate the request. Create the file and generate the CSR on the Windows Server computer that hosts the Horizon 8 server that will use the certificate.
2. Create a CSR Configuration File from Horizon Console
   If your organization does not provide you with an TLS server certificate, you must request a new certificate that is signed by a CA. To obtain a new signed certificate you must generate a Certificate Signing Request (CSR) and submit a certificate request to a CA. You can do this from the Horizon Console.
3. Generate a CSR and Request a Signed Certificate from a CA
   Using the completed configuration file, you can generate a CSR by running the certreq utility. You send the request to a third-party CA, which returns a signed certificate.
4. Verify That the CSR and Its Private Key Are Stored in the Windows Certificate Store
   If you use the certreq utility to generate a CSR, the utility also generates an associated private key. The utility stores the CSR and private key in the Windows local computer certificate store on the computer on which you generated the CSR. You can confirm that the CSR and private key are properly stored by using the Microsoft Management Console (MMC) Certificate snap-in.
5. Import a Signed Certificate by Using Certreq
   When you have a signed certificate from a CA, you can import the certificate into the Windows local computer certificate store on the Horizon 8 server host.
6. Set Up an Imported Certificate for a Horizon 8 Server
   After you import a server certificate into the Windows local computer certificate store, you must take additional steps to allow a Horizon 8 server to use the certificate.