How To

How to Install Certificates on Microsoft Active Directory LDAP 2012

To install the SSL Certificate on your Microsoft Active Directory LDAP server, complete the steps below.

Microsoft AD LDAP (2012): Importing Your Certificate .pfx File into the AD DS Personal Store

Once you have your .pfx certificate file, use Microsoft Management Console (MMC) to import it into the Active Directory Domain Services Personal Store.

Importing the .pfx Certificate File

  1. Open the Microsoft Management Console (MMC) as an admin.
    • From the Windows Start screen, type mmc.
    • Right-click on mmc.exe.
    • In the menu at the bottom of the screen, click Run as administrator.
  2. In the User Account Control window, click Yes to allow the program to make changes to the computer.
  3. In the MMC Console, click File > Add/Remove Snap-in.
  4. MMC Add or Remove Snap-in
  5. In the Add or Remove Snap-ins window, under Available snap-ins, select Certificates and then, click Add.Add or Remove Snap-ins window, add Certificates
  6. In the Certificates snap-in window, select Service account and then, click Next.
  7. Certificates snap-in window, select Service account
  8. In the Select Computer window, select Local computer: (the computer this console is running on) and then, click Next.Select Computer window, select Local computer
  9. In the Certificates snap-in window, select Active Directory Domain Services and then, click Finish.Certificates snap-in window, select Active Directory Domain Services
  10. In the Add or Remove snap-ins window, click OK.
  11. Add or Remove snap-ins window
  12. In the MMC Console, in the console tree, expand Certificates - Service (Active Directory Domain Services), right-click on NTDS/Personal, and select Import.MMC Console
  13. In the Certificate Import Wizard, on the Welcome to the Certificate Import page, click Next.
  14. Certificate Import Wizard Welcome page
  15. On the File to Import page, click Browse to browse for and select the .pfx certificate file (e.g. your_domain_com.pfx) that you exported using the DigiCert Certificate Utility, select the file, click Open, and then, click Next.
  16. Certificate Import Wizard File to Import page
  17. On the Password page, do the following:
    1. In the Password box, enter the password that you created when you exported the .pfx certificate file.
    2. Check Include all extended properties.
    3. Check Mark this key as exportable.
    4. Click Next.
    Certificate Import Wizard Password page
  18. On the Certificate Store page, leave the default settings and click Next.

    Default Settings:

    1. Place all certificates in the following store.
    2. Certificate store: NTDS\Personal
    Certificate Import Wizard Certificate Store page
  19. On the Completing the Certificate Import page, review your settings and then, click Finish.
  20. Completing the Certificate Import page
  21. All your client computers should now be able to make SSL connections to all your domain controllers in the forest.

Verify SSL Was Successfully Configured

  1. Open the LDP snap-in as and admin.
    • From the Windows Start screen, type ldp.
    • Right-click on ldp.exe.
    • In the menu at the bottom of the screen, click Run as administrator.
  2. In the User Account Control window, click Yes to allow the program to make changes to the computer.
  3. In Ldp, click Connection > Connect.
  4. Ldp window Connect
  5. In the Connect window, do the following:
      • In the Server box, enter the hostname of to which you are connecting.
      • In the Port box, enter 636.
      • Check SSL.
      • Uncheck Connectionless.
      • Click OK.
    Connect window
  6. The command output should display the user name and the domain name for the binding.
  7. If you receive the Cannot open connection message, LDAP-over-SSL binding is not configured properly.
  8. Cannot open connection message
  9. Click OK.
  10. Next, in LDP, click Connection > Bind.
  11. Ldp window Bind
  12. In the Bind window, click OK.
  13. Bind window
  14. The command output should now display the user name and the domain name for the binding.