Home
%3CLINGO-SUB%20id%3D%22lingo-sub-714767%22%20slang%3D%22en-US%22%3EGetting%20Started%20with%20Windows%2010%20Device%20Guard%20-%20Create%20Code%20Integrity%20Signing%20Certificate%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-714767%22%20slang%3D%22en-US%22%3E%0A%20%26lt%3Bmeta%20http-equiv%3D%22Content-Type%22%20content%3D%22text%2Fhtml%3B%20charset%3DUTF-8%22%20%2F%26gt%3B%3CSTRONG%3EFirst%20published%20on%20TECHNET%20on%20May%2004%2C%202017%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3E%20%3CA%20href%3D%22https%3A%2F%2Fblogs.technet.microsoft.com%2Fukplatforms%2F2017%2F05%2F04%2Fgetting-started-with-windows-10-device-guard-part-2-of-2%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Back%20to%20Getting%20Started%20with%20Windows%2010%20Device%20Guard%20%E2%80%93%20Part%202%20of%202%20contents%3C%2FA%3E%20%3CBR%20%2F%3E%3CH3%20id%3D%22toc-hId-1592263843%22%20id%3D%22toc-hId-1592349589%22%3EGetting%20Started%20with%20Windows%2010%20Device%20Guard%20-%20Create%20Code%20Signing%20Certificate%3C%2FH3%3E%3CBR%20%2F%3E%20To%20sign%20our%20catalog%2C%20we%20require%20a%20code%20signing%20certificate.%26nbsp%3B%20On%20the%26nbsp%3Bcertificate%20authority%20open%20up%20the%20snap-in%20by%20running%20the%20following%20command.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%3CCODE%3E%0A%20%20%20certsrv.msc%0A%20%20%3C%2FCODE%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CIMG%20alt%3D%22debs-certsrv%22%20class%3D%22alignnone%20size-medium%20wp-image-1735%22%20height%3D%22161%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F120215iDA9981E603AE37FD%22%20width%3D%22300%22%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20Expand%20the%20server%2C%20right%20click%20on%20the%20Certificate%20Template%20folder%20and%20select%20Manage.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CIMG%20alt%3D%22debs-ci-manage%22%20class%3D%22alignnone%20size-full%20wp-image-1825%22%20height%3D%22626%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F120216iD874F31976FEAC7B%22%20width%3D%22789%22%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20In%20the%20certificates%20template%20console%2C%20right%20click%20on%20the%20Code%20Signing%20template%20and%20click%20duplicate%20template.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CIMG%20alt%3D%22debs-code-signing%22%20class%3D%22alignnone%20size-full%20wp-image-1845%22%20height%3D%22454%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F120218iC76EC7E82849B5BD%22%20width%3D%22898%22%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20On%20the%20Compatibility%20tab%2C%20clear%20the%20Show%20resulting%20changes%20check%20box.%20Select%20Windows%20Server%202012%20from%20the%20Certification%20Authority%20list%2C%20and%20then%20select%20Windows%208%20%2F%20Windows%20Server%202012%20from%20the%20Certificate%20recipient%20list.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CIMG%20alt%3D%22debs-cert1%22%20class%3D%22alignnone%20size-full%20wp-image-1775%22%20height%3D%22787%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F120219i506BCB21FB425101%22%20width%3D%22807%22%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20On%20the%20General%20tab%2C%20specify%20the%20Template%20display%20name%20and%20Template%20name.%20We%20will%20call%20it%20DG%20Catalog%20Signing%20Certificate.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CIMG%20alt%3D%22debs-cert2%22%20class%3D%22alignnone%20size-full%20wp-image-1785%22%20height%3D%22760%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F120220iC6B1FA04B17F2552%22%20width%3D%22811%22%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20On%20the%20Request%20Handling%20tab%2C%20select%20the%20Allow%20private%20key%20to%20be%20exported%20check%20box.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CIMG%20alt%3D%22debs-cert3%22%20class%3D%22alignnone%20size-full%20wp-image-1787%22%20height%3D%22762%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F120221iEBC7B53BF89471FB%22%20width%3D%22801%22%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20On%20the%20Extensions%20tab%2C%20select%20the%20Basic%20Constraints%20check%20box%2C%20and%20then%20click%20Edit.%20In%20the%20Edit%20Basic%20Constraints%20Extension%20dialog%20box%2C%20select%20Enable%20this%20extension.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CIMG%20alt%3D%22debs-cert4%22%20class%3D%22alignnone%20size-full%20wp-image-1795%22%20height%3D%22772%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F120222i4E325AC112C48156%22%20width%3D%22791%22%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20If%20a%20certificate%20manager%20is%20required%20to%20approve%20any%20issued%20certificates%2C%20on%20the%20Issuance%20Requirements%20tab%2C%20select%20CA%20certificate%20manager%20approval.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20On%20the%20Subject%20Name%20tab%2C%20select%20Supply%20in%20the%20request.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CIMG%20alt%3D%22debs-cert5%22%20class%3D%22alignnone%20size-full%20wp-image-1805%22%20height%3D%22751%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F120223i1843F15F478F9735%22%20width%3D%22796%22%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20On%20the%20Security%20tab%2C%20verify%20that%20whatever%20account%20will%20be%20used%20to%20request%20the%20certificate%20has%20the%20right%20to%20enrol%20the%20certificate.%20We%20will%20leave%20the%20defaults%20but%20you%20can%20granulate%20as%20you%20see%20fit.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CIMG%20alt%3D%22debs-cert6%22%20class%3D%22alignnone%20size-full%20wp-image-1815%22%20height%3D%22747%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F120224iBBD7A9EF92A16B41%22%20width%3D%22797%22%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20Click%20OK%20to%20create%20the%20template%2C%20and%20then%20close%20the%20Certificate%20Template%20Console.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20Now%20that%20we%20have%20created%20the%20code%20integrity%20certificate%20template%2C%20we%20must%20publish%20it%20to%20the%20CA%20published%20template%20store.%20To%20do%20so%2C%20we%20will%20right-click%20Certification%20Templates%2C%20point%20to%20New%2C%20and%20then%20click%20Certificate%20Template%20to%20Issue.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CIMG%20alt%3D%22debs-ci-issue%22%20class%3D%22alignnone%20size-full%20wp-image-1855%22%20height%3D%22673%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F120225i6F5C7E1DCFA94FCF%22%20width%3D%22815%22%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20Select%20the%20DG%20Catalog%20signing%20certificate%2C%20and%20then%20click%20OK.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CIMG%20alt%3D%22debs-code-sign-template-issue%22%20class%3D%22alignnone%20size-full%20wp-image-2005%22%20height%3D%22592%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F120226i14D1935F7D8184FB%22%20width%3D%22833%22%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20Now%20that%20the%20template%20is%20available%20to%20be%20issued%2C%20we%20must%20request%20one%20from%20the%20computer%20running%20Windows%2010%20on%20which%20we%20will%20create%20and%20sign%20catalog%20files%2C%20in%20our%20case%2C%20this%20will%20be%20our%20GOLD-MACHINE.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20On%20GOLD-MACHINE%2C%20type%20MMC%20in%20a%20run%20box%2C%20from%20the%20File%20menu%2C%20click%20Add%2FRemove%20Snap-in.%20Double-click%20Certificates%2C%20and%20then%20select%20My%20user%20account.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20In%20the%20Certificates%20snap-in%2C%20right-click%20the%20Personal%20store%20folder%2C%20point%20to%20All%20Tasks%2C%20and%20then%20click%20Request%20New%20Certificate.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CIMG%20alt%3D%22debs-request-new-certificate%22%20class%3D%22alignnone%20size-full%20wp-image-2015%22%20height%3D%22543%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F120227i0EB9B86F6CA601D8%22%20width%3D%221272%22%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20Click%20Next%20twice%20to%20get%20to%20the%20certificate%20selection%20list.%20In%20the%20Request%20Certificate%20list%2C%20select%20your%20newly%20created%20code%20signing%20certificate%2C%20and%20then%20select%20the%20blue%20text%20that%20requests%20additional%20information.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CIMG%20alt%3D%22debs-request-new-certificate-enroll%22%20class%3D%22alignnone%20size-full%20wp-image-2025%22%20height%3D%22583%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F120228i0CC220518A9B5954%22%20width%3D%221171%22%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20In%20the%20Certificate%20Properties%20dialog%20box%2C%20under%20Subject%20Name%2C%20for%20Type%2C%20select%20Common%20name.%20For%20Value%2C%20select%20ContosoDGSigningCert%2C%20and%20then%20click%20Add.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CIMG%20alt%3D%22debs-request-new-certificate-common-name%22%20class%3D%22alignnone%20size-full%20wp-image-2026%22%20height%3D%22768%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F120229i810C59AB78B54143%22%20width%3D%22839%22%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20Select%20the%20certificate%20and%20click%20Enroll.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CIMG%20alt%3D%22debs-request-new-certificate-enroll-and-finish%22%20class%3D%22alignnone%20size-full%20wp-image-2035%22%20height%3D%22595%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F120230i1C010028C47129E8%22%20width%3D%22670%22%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20On%20successful%20enrolment%2C%20click%20Finish.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CIMG%20alt%3D%22debs-request-new-certificate-enroll-suceeded%22%20class%3D%22alignnone%20size-full%20wp-image-2036%22%20height%3D%22566%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F120231i03AD98216E875D6F%22%20width%3D%22700%22%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20Let's%20navigate%20to%20our%20certificate%20personal%20store%20to%20verify%20that%20we%20now%20have%20our%20new%20ContosoDGSigningCert%20certificate.%26nbsp%3B%20Open%20a%20MMC%20snap-in%2C%20click%20file%2C%20add%2Fremove%20snap-in%2C%20select%20certificates%20in%20the%20left%20hand%20pane%20and%20click%20add.%26nbsp%3B%20When%20prompted%2C%20select%20user%20account.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CIMG%20alt%3D%22debs-cert-present%22%20class%3D%22alignnone%20size-full%20wp-image-1915%22%20height%3D%22585%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F120232i52534EC46F09B02A%22%20width%3D%22950%22%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CSTRONG%3E%0A%20%20%20Note%0A%20%20%3C%2FSTRONG%3E%0A%20%20The%20certificate%20must%20be%20installed%20in%20the%20user%E2%80%99s%20personal%20store%20on%20the%20computer%20that%20will%20be%20signing%20catalog%20files%20and%2For%20code%20integrity%20policies%20(in%20our%20case%20GOLD-MACHINE).%20Because%20the%20signing%20is%20going%20to%20take%20place%20on%20the%20computer%20that%20we%20just%20requested%20the%20certificate%20on%2C%20we%20don't%20need%20to%20export%20the%20certificate%20as%20it%20already%20exists%20in%20our%20personal%20store.%20If%20you%20are%20signing%20on%20another%20computer%2C%20you%20will%20need%20to%20export%20the%20.pfx%20certificate%20with%20the%20necessary%20keys%20and%20properties%20and%20secure%20using%20a%20strong%20password.%20When%20the%20certificate%20has%20been%20exported%2C%20import%20it%20into%20the%20personal%20store%20for%20the%20user%20who%20will%20be%20signing%20the%20catalog%20files%20or%20code%20integrity%20policies%20on%20the%20specific%20computer%20that%20will%20be%20signing%20them.%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CSTRONG%3E%0A%20%20%20Important%20Note%0A%20%20%3C%2FSTRONG%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CP%20id%3D%22sign-catfiles%22%3E%0A%20%20%20Be%20sure%20to%20backup%20and%20protect%20your%20PKI%20infrastructure.%0A%20%20%3C%2FP%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20Chris%20Ayres%20has%20written%20a%20great%20blog%20that's%20really%20worth%20checking%20out!%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CA%20href%3D%22https%3A%2F%2Fblogs.technet.microsoft.com%2Fparanoidhumanoid%2F2015%2F09%2F15%2Fcertificate-services-disaster-recovery%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3E%0A%20%20%20https%3A%2F%2Fblogs.technet.microsoft.com%2Fparanoidhumanoid%2F2015%2F09%2F15%2Fcertificate-services-disaster-recovery%2F%0A%20%20%3C%2FA%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CA%20href%3D%22%23top%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%0A%20%20%20Back%20to%20Top%0A%20%20%3C%2FA%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CBR%20%2F%3E%0A%20%20%3CA%20href%3D%22https%3A%2F%2Fblogs.technet.microsoft.com%2Fukplatforms%2F2017%2F05%2F04%2Fgetting-started-with-windows-10-device-guard-part-2-of-2%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3E%0A%20%20%20Back%20to%20Getting%20Started%20with%20Windows%2010%20Device%20Guard%20%E2%80%93%20Part%202%20of%202%20contents%0A%20%20%3C%2FA%3E%0A%20%0A%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-714767%22%20slang%3D%22en-US%22%3EFirst%20published%20on%20TECHNET%20on%20May%2004%2C%202017%20Back%20to%20Getting%20Started%20with%20Windows%2010%20Device%20Guard%20%E2%80%93%20Part%202%20of%202%20contentsGetting%20Started%20with%20Windows%2010%20Device%20Guard%20-%20Create%20Code%20Signing%20CertificateTo%20sign%20our%20catalog%2C%20we%20require%20a%20code%20signing%20certificate.%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-714767%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Ecertificate%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Ecode%20integrity%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Ecode%20signing%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EDevice%20Guard%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Microsoft
First published on TECHNET on May 04, 2017
Back to Getting Started with Windows 10 Device Guard – Part 2 of 2 contents

Getting Started with Windows 10 Device Guard - Create Code Signing Certificate


To sign our catalog, we require a code signing certificate.  On the certificate authority open up the snap-in by running the following command.

certsrv.msc

debs-certsrv



Expand the server, right click on the Certificate Template folder and select Manage.

debs-ci-manage



In the certificates template console, right click on the Code Signing template and click duplicate template.

debs-code-signing



On the Compatibility tab, clear the Show resulting changes check box. Select Windows Server 2012 from the Certification Authority list, and then select Windows 8 / Windows Server 2012 from the Certificate recipient list.

debs-cert1



On the General tab, specify the Template display name and Template name. We will call it DG Catalog Signing Certificate.

debs-cert2



On the Request Handling tab, select the Allow private key to be exported check box.

debs-cert3



On the Extensions tab, select the Basic Constraints check box, and then click Edit. In the Edit Basic Constraints Extension dialog box, select Enable this extension.

debs-cert4
If a certificate manager is required to approve any issued certificates, on the Issuance Requirements tab, select CA certificate manager approval.



On the Subject Name tab, select Supply in the request.

debs-cert5



On the Security tab, verify that whatever account will be used to request the certificate has the right to enrol the certificate. We will leave the defaults but you can granulate as you see fit.

debs-cert6

Click OK to create the template, and then close the Certificate Template Console.



Now that we have created the code integrity certificate template, we must publish it to the CA published template store. To do so, we will right-click Certification Templates, point to New, and then click Certificate Template to Issue.

debs-ci-issue



Select the DG Catalog signing certificate, and then click OK.

debs-code-sign-template-issue

Now that the template is available to be issued, we must request one from the computer running Windows 10 on which we will create and sign catalog files, in our case, this will be our GOLD-MACHINE.



On GOLD-MACHINE, type MMC in a run box, from the File menu, click Add/Remove Snap-in. Double-click Certificates, and then select My user account.

In the Certificates snap-in, right-click the Personal store folder, point to All Tasks, and then click Request New Certificate.

debs-request-new-certificate



Click Next twice to get to the certificate selection list. In the Request Certificate list, select your newly created code signing certificate, and then select the blue text that requests additional information.

debs-request-new-certificate-enroll



In the Certificate Properties dialog box, under Subject Name, for Type, select Common name. For Value, select ContosoDGSigningCert, and then click Add.

debs-request-new-certificate-common-name



Select the certificate and click Enroll.

debs-request-new-certificate-enroll-and-finish



On successful enrolment, click Finish.

debs-request-new-certificate-enroll-suceeded



Let's navigate to our certificate personal store to verify that we now have our new ContosoDGSigningCert certificate.  Open a MMC snap-in, click file, add/remove snap-in, select certificates in the left hand pane and click add.  When prompted, select user account.

debs-cert-present

Note The certificate must be installed in the user’s personal store on the computer that will be signing catalog files and/or code integrity policies (in our case GOLD-MACHINE). Because the signing is going to take place on the computer that we just requested the certificate on, we don't need to export the certificate as it already exists in our personal store. If you are signing on another computer, you will need to export the .pfx certificate with the necessary keys and properties and secure using a strong password. When the certificate has been exported, import it into the personal store for the user who will be signing the catalog files or code integrity policies on the specific computer that will be signing them.



Important Note

Be sure to backup and protect your PKI infrastructure.


Chris Ayres has written a great blog that's really worth checking out!
https://blogs.technet.microsoft.com/paranoidhumanoid/2015/09/15/certificate-services-disaster-re...



Back to Top

Back to Getting Started with Windows 10 Device Guard – Part 2 of 2 contents