How do I enable HTTP Secure (HTTPS) traffic on my Microsoft Internet Information Systems (IIS) 6.0 Web server site by using my local forest Certificate Authority (CA)?

A. If you have Certificate Services installed in your Active Directory (AD) forest, enabling HTTPS traffic on a Web server is a simple exercise. To do so, perform these steps:

1. Log on to the Web server as an account with local Administrator privileges (to allow certificates to be installed into the computer's local certificate store).
2. Start the Internet Information Services Manager (Start, Programs, Administrative Tools, Internet Information Services--IIS--Manager).
3. Expand Web Sites and right-click the Web site for which you want to enable HTTPS communication (e.g., Default Web Site) and select Properties.
4. Select the Directory Security tab and click Server Certificate, as Figure 2shows.
5. Click Next on the "Welcome to the Web Server Certificate Wizard" page.
6. Select "Create a new certificate" and click Next.
7. You now choose whether to immediately request the certificate or prepare a request to be submitted later. If the CA is correctly configured in the AD forest, select the "Send the request immediately to an online certificate authority." Click Next.
8. Enter a name for the certificate (e.g., Exchange Web Server SSL), as Figure 3 shows. Leave the default values for bit length and cryptographic service provider (CSP). Click Next.
9. Enter the organization's name and unit (e.g., SavillTech and IT) and click Next.
10. Enter the common name (CN) of the certificate. This name must be the full name of how users will access the Web site (e.g., savdalex01.savilltech.com) and click Next.
11. Enter the Country, State, and City and click Next.
12. You'll be prompted for the port to be used for Secure Sockets Layer (SSL). Leave it as the default (443) and click Next.
13. You'll see a list of CAs known to AD. Select one and click Next.
14. You'll see a confirmation of the certificate request. Click Next.
15. The screen displays a success message. Click Finish. After you install the certificate, Web clients will be able use HTTPS.

If you have concerns with this approach, you can use the Web-based enrollment method. (I know of people who were unable to get this auto enrollment process to work. Usually this occurs because firewall or server-side configuration issues on the certificate server prevent remote procedure call (RPC) from being available):

1. Log on to the IIS server.
2. Go to http:///certsrv/ .
3. Click "Request a certificate."
4. Click "Advanced certificate request."
5. Click "Create and submit a request to this CA."
6. Complete the Certificate Template form, ensuring that the Certificate Template is set to Web Server and the "Store certificate in the local computer certificate store" check box is selected, as Figure 4 shows. The Name field needs to match how the clients will connect to the server (the server part of the URL).
7. Click Submit.
8. Click Yes to the security warning.
9. You'll see a new Web page. Select "Install this certificate" and click Yes to the security warning.
10. You'll see a message saying the certificate was successfully installed

You can now click the Server Certificate button under the Directory Security of the Web site, then select "Assign an existing certificate" and select the installed certificate.