How to Create an Offline Certificate Request in Windows Server

Certificate enrollment wizard

1. From the Certificate manager console, go to Certificates (Local Computer) > Personal > Certificates.  

2. Right-click Certificates and go to All tasks > Advanced options, then select Create custom request. 

3. The Certificate Enrollment Wizard opens. Review the Before You Begin section and click Next. 

4. Choose Proceed without enrollment policy unless a predefined certificate template needs to be used.

5. For Custom Request options, choose the No template and click Next.

Certificate properties: General tab

1. On Certificate Information, expand Details, then click the Properties button. 

2. When Certificate Properties opens to the General tab, fill out the Friendly name and Description values. These values are not required, but they help distinguish your certificate among other installed certificates. 

Certificate properties: Subject tab

1. Select the Subject tab.  

2. Add values to the Subject name and Alternative name attributes.  
   a. To add an attribute, select an attribute Type from the drop-down, enter the correct Value, and then click Add.
   b. Subject name:
       1. Common name (required): Fully Qualified Domain Name (FQDN) of your RADIUS server host. Most commercial CAs require the host to have a public top-level domain such as .com or .net (for example, myserver.mydomain.com).
       2. Organizational Unit (optional): Depends on your organization; this could be your department.
       3. Organization (optional): Your organization name.
       4. Locality (optional): Your city. Do not abbreviate.
       5.  State (optional): Your state. Do not abbreviate.
       6. Country (optional): Your country.
   c. Alternative name: 
       1. DNS (required): FQDN of your RADIUS server host. Most commercial CAs require the host to have a public top-level domain such as .com or .net (for example, myserver.mydomain.com). 

Certificate properties: Extensions tab

1. Select the Extensions tab, expand Key usage. 

2. Select Digital signature and Key encipherment from Available options. 

3. Click Add to place them in Selected options. The Make these key usages critical box is checked by default. 

4. On the Extensions tab, expand Extended Key Usage (application policies). 

5. Select Server Authentication and optionally Client Authentication from Available options. 

6. Click Add to place them in Selected options. 

Certificate properties: Private Key tab

1. Select the Private Key tab.  

2. Expand Cryptographic Service Provider. For Select cryptographic service provider, make sure RSA, Microsoft Software Key Storage Provider is the only box checked.  

3. Expand Key options and select 2048 in the Key size drop-down.

4. On the Private Key tab, expand Select Hash Algorithm.  

5. For the Hash Algorithm drop-down, select sha1, which is the only hashing algorithm compatible with dynamic keying, and then click OK. 

Save certificate request

1. On the Where do you want to save the offline request? page, give your certificate request file a name and save it to a location on your computer. 

2. In the example below, the certificate request file is named certreq711 and is saved at the root of C:. Make sure the File format is set to Base 64, and then click Finish. 

Submit the certificate request to a CA

1. After creating your certificate request, submit it to a Certificate Authority so they can process the request and issue a certificate.  

2. The certificate request is a text file. Copy the text from the file and enter it into an online submission form on the CA website.  

3. Contact your Certificate Authority directly for instructions on the process for submitting your certificate request. 

4. Once CA processes the request and issues the certificate, download it to server so it can be imported.  

5. Go to Microsoft documentation for instructions on how to import the certificate.