stand alone certificate server, needs IIS??

[routerman]

I'm trying to use X509 certificates with cisco routers, and want to set up the certificate server on a win2k box. so i thought I'd dig out my MCSE training kit and follow the section on setting up a certificate server.

Going through the certificate server set up seems straight forward, but I'm unable to use my web browser to look at the certificate services enrollment page. I'm setting up a standalone Root CA as I'm not running AD.

To keep it simple the router is directly connected to the server, I can ping the server from the router using both the IP and hostname, so name resolution is ok.

Does the CA need to use IIS, as that is not configured yet, the default web server is stopped and wont start. Do I need this, or am I wasting time fixing IIS first?


I've gone through the online help, I cannot see anywhere where I have deviated from the process, but the fact that I cannot see the CA pages from IE bothers me. The router enrollment process fails, I think the 2 problems are related.

Any one got any pointers?

 

[yanks2112]

If I understand correctly you are looking to issue certificates via the browser. In order to do this you need to have IIS installed and configured. When you set up IIS create a virtual directory and browse to the path of you certificate files. When you create the virtual directory you can call it whatever you want, but remeber the name because this is how you will access the directory via the browser.
For example if you name your virtual directory "certificate", then you would type into the browser:

http://<servername>/certificate/

Hope this helps

 

[routerman]

Thanks for that, I eventually got it working. I wanted to get the router to obtain a certificate from the MS CA, but encountered problems. I found that the router needed to use HTTP to get the cert, and then found IIS was screwed up on the CA. Reinstalling the IIS and CA, as well as SECP from the resource kit plus SP4 fixed it. What a struggle, but got there anyway.

It was the browser test that suggested I look at IIS first.