Generating the Browser Client Certificate

You can generate the client certificate by openssl or keytool in P12 format and import it in the browser. Importing the certificates depends on the browser.

The following steps are an example of generating a client certificate using openssl. Clients can also use keytool or Microsoft CA to generate the client certificate

To generate the client certificate using openssl:

1. Generate the private key

   openssl genrsa -aes256 -out renclient.key

2. Use the private key to generate a certificate request. When you create this request, ensure that the certificate is issued to your identity. This may mean using your email address as the common name when prompted.

   openssl req -new -key renclient.key -days 365 -out renclient.csr

3. Send the CSR file to CA to get the certificate.

   Download the certificate as a base64-encoded renclient.cer file. Note that base64-encoded cer files are PEM files.

   Also download the CA's certificate as RootCA.cer, which is also base64-encoded.

4. Generate a p12 archive containing the downloaded certificates and the private key.

   openssl pkcs12 -export -out renclient.pfx -inkey renclient.key -in RootCA.cer -in renclient.cer

   The renclient.pfx contains the private key.

   Note:

   The files created when you follow steps 1 through 4 are renclient.key, renclient.csr, renclient.cer, RootCA.cer, and renclient.pfx.

5.  Next, install the RootCA certificate. On Windows-based machines, this is done with certmgr.

6.  Install the renclient.pfx file.

   Note:

   Similar to step 5, on Windows-based machine, you can install renclient.pfx file with certmgr by remembering to use the appropriate certificate storage for personal certificates.

7. Go to the REN Server Buffer Test page, with client certificates enabled for the REN server. The browser will prompt you to choose a client certificate to use.