Here are some high level steps that walk you through procuring a VeriSign certificate and configuring it for the Intel Setup and Configuration Service (SCS). Other certificate vendors like Go Daddy, Starfield, Comdo, etc will have different purchasing processes.


Purchase Verisign Certificate







  1. Generate Certificate Signing Request (CSR) by following the instruction in the link,

  2. The Common Name (CN) needs to be the FQDN of the server you want to install this certificate on. (i.e. host name + domain name)

  3. Enter ‘Intel(R) Client Setup Certificate' for Organization Unit (OU).

  4. Complete all the steps. Visit VeriSign website, [] to start purchasing process. Select ‘Secure Site: SSL Certificates' under ‘Buy Individual SSL Certificates'.
         Note: you could choose the other two, which are in more advanced level, depending on your need.

  5. Enter all the information required and copy the CSR generated by the server

  6. Complete all the steps and print out the order confirmation page for your record.

  7. You will receive an email of Verisign automated order verification within few hours. You have only 24 hours, after receiving the email, to finish this process. Click the link in the email and go through the process.

    *Important:* If you cannot recognize the second phone number listed on the webpage, cancel the automated verification process and have them call you instead.





Certificate Installation and Exporting








  1. You will receive the link of installation instruction in the email containing the certificate. Follow the instruction to complete installation

  2. VeriSign will send you the SSL certificate via email. If the certificate is an attachment (Cert.cer), save the file to the hard drive. If the certificate is in the body of the email, create a .cer file (example: NewCertificate.cer) by copying and pasting the certificate text into a plain text editor such as Notepad or Vi. Please be sure to include the header and footer as well as the surrounding dashes. Do not use Microsoft Word or other word processing programs that may add characters. Confirm that there are no extra lines or spaces in the file.

  3. Open the Internet Services Manager (IIS). Click Start > All Programs > Administrative Tools > Internet Information Services (IIS) Manager.

  4. Under Web Sites, right-click your web site and select Properties.

  5. Click the Directory Security tab.

  6. Under Secure Communications, click Server Certificate.

  7. The Web Site Certificate Wizard will open, click Next.

  8. Choose Process the Pending Request and Install the Certificate, then click Next.

  9. Important: The pending request must match the response file. If you deleted the pending request in error you must generate a new CSR and replace this certificate.

  10. Select the location of the certificate response file, and then click Next.

  11. Read the summary screen to be sure that you are processing the correct certificate and then click Next.

  12. You see a confirmation screen.

  13. After you read this information, click Next.

  14. Go back to IIS Manager (Start > Programs > Administrative Tasks > IIS Manager)

  15. Expand Web Sites and right click Default Web Site

  16. Under Secure Communications, click View Certificate...

  17. select Detail tab

  18. Click Copy to file at right bottom of window, the Certificate Export wizard will pop up. (N)

  19. choose Yes, export the private key (N)

  20. mark Include all certificates in the certification path if possible (N)

  21. give a password (can be weak password) and confirm (N)

  22. Give location and file name for the resulting PFX. (N), Finish, Ok.

  23. Close all windows.


















Adding Cert To SCS




Install the certificate created above in the System Certificate Store on the platform where the SCS executes. Follow the following steps:








  1. Open certificates (local computer) using the Microsoft Management Console (MMC). To add the certificates plug-in to the MMC,

  2. Select file/add snap-in.

  3. Select Add....

  4. Select Certificates.

  5. Select computer account; click Next.

  6. Select Local computer; click Next.

  7. Select Finish; Close; select Certificates and click OK.

  8. In the console tree, click the logical store where the mmc will import the certificate.

  9. On the Action menu, point to All Tasks and then click Import to start the Certificate Import Wizard.

  10. Type the path and file name of the certificate to be imported or click Browse and navigate to the file. Select automatically select the certificate store based on the type of certificate.


Invoke the loadcert utility




  1. Located at <install_root>:\Program files\Intel\AMTConfServer\Tools.

  2. Double-click on loadcert.exe

  3. Select the certificate that was just imported. The utility will report any problems in the certificates that it detects that would prevent using it as a ZTC certificate.


Matt Royer