Requesting certificates with CertMaker

To generate a request for a server certificate on Windows, use the CertMaker utility (sdk_installdir/bin/certmaker.exe) provided with the Windows UP.SDK.

CertMaker generates a public-private key pair and a Certificate Signing Request (CSR). You copy and paste the CSR generated by CertMaker into the WWW-based certificate request form provided by the Certificate Authority.

The Certificate Authority responds to the email with a certificate, which you should save and install as described in Installing certificates with upcerins.

To request a certificate, follow these steps:

1. From the Start>Programs>UP.SDK 3.1 menu, choose CertMaker.

The CertMaker utility appears.

2. Choose Create Request from the Certificate menu.

The first page of the Create Request Wizard appears.

3. Enter the information the Certificate Request Wizard prompts you for.

When you have completed entering information on a page, click Next to proceed to the next page. The Wizard saves the information you enter to a file; so if you need to quit before you are done, you can resume work at another time without having to re-enter anything.

The Certificate Request Wizard prompts you for the following information:

Field	Description
Destination Dir:	The directory to which to store files generated by CertMaker.
Filename:	The basename for files that CertMaker generates. For example, if you specify the basename mycert, CertMaker generates files such as the following:  mycert.csr mycert.pvk
Common-Name	Specify a fully or partially qualified domain name. The Common-name must match exactly, or be an immediate subdomain of, the domain that hosts the notification alert and prefetch URLs.  For example, if you specify bar.com, the UP.Link server accepts notifications that specify URLs such as the following:  http://bar.com/mydeck.hdml   It does not accept:  http://foo.bar.com/mydeck.hdml   Alternatively, if you specify foo.bar.com, the UP.Link server accepts notifications that specify URLs such as the following:  http://foo.bar.com/mydeck.hdml http://bar.com/mydeck.hdml   It does not accept:  http://gold.bar.com/mydeck.hdml http://foo.fred.com/mydeck.hdml   Unwired Planet recommends that you use a Common-Name that specifies a subdomain of the domain that hosts the notification URLs.1  If the domain changes, you must obtain another certificate from the Certificate Authority.
Organization	Specify the name of the organization providing the HDML service.
Organization Unit	Specify the name of the business unit providing the HDML service (for example, Engineering).
Locality	Specify the town or city where the organization providing the HDML service is located. Do not abbreviate.
Webmaster	Specify the fully qualified email address of the person requesting the certificate on behalf of the UP.Link service. For example:  jane_doe@mycompany.com  The CertMaker tool provides this address as the "Reply to" address in the certificate request. The Certificate Authority returns the certificate to this address.
State	Specify the country where the organization providing the HDML service is located. Do not abbreviate.
Country	Specify the country where the organization providing the HDML service is located.
Phone	Specify the phone number of the requestor. The phone number will not appear in the certificate itself. It is only used for administrative purposes.
Password	Specify a password for the certificate. Remember this password. You will need to specify it when you send secure notifications to the UP.Link server. CertMaker does not save the password to a file.

1 This is because most Certificate Authorities will not permit you to have two certificates for the same domain. For example, if you already have a server certificate for foo.com, you can't also get an application certificate for that domain. So, you should request the application certificate for a subdomain of foo.com, such as bar.foo.com. If your application certificate specifies bar.foo.com, the UP.Link server will honor your notifications as long as the alert and prefetch URLs have the domain bar.foo.com (or just foo.com).

---

IMPORTANT     You must specify the Common-Name correctly. If you do not, the UP.Link server will not accept notifications from your service. When you specify the Common-Name, keep in mind that the UP.Link server will accept notifications only if the notification URL domain matches the Common-Name domain exactly or the Common-Name is an immediate subdomain of the notification URL domain.

---

After you have completed the last page in the Certificate Request Wizard and clicked Finish, CertMaker displays the CSR it has created (see Figure 2-1) and generates a private key file. This may take a few moments.

FIGURE  2-1.     Certificate Signing Request (CSR) generated by CertMaker



4. Copy and paste the contents of the CSR into a Certificate Authority's certificate request form.

Most Certificate Authorities provide WWW forms that allow you to request certificates. The URLs of Verisign's request forms are:

https://digitalid.verisign.com/server_ids.html (real)
http://digitalid.verisign.com/test_server_ids.html (test)

Some Certificate Authorities also provide email addresses to which you can directly email the CSR.

You can copy the CSR directly from CertMaker and paste it into a certificate request email or WWW form. If you want submit the request at a later time, you can retrieve the archived CSR from the .csr file saved by CertMaker in the directory you specified.

Within several days of when you submit the certificate request, the Certificate Authority should send you a certificate response by email. To use the certificate, you must install it as described in Installing certificates with upcerins.