Windows Certificate Store

You must have access to the certmgr.msc file with the ability to import a certificate and key into the Personal store. (This should be true by default for most Windows users.)

The user doing the configuration must have a copy of the OpenSSL command-line tool.

The server and client must already be configured to use a custom SSL certificate, as described in Using Custom Certificates, giving instructions to store the client certificate in the Windows certificate store rather than storing it in the Certificates directory.

Open a command prompt or terminal and navigate to the directory:

<CommonName>.pem c: cd \<DWB Install folder \Certificates

Run openssl with the following arguments (with the actual .pem file name):

openssl pkcs12 -in "<Common Name>.pem" -export -out "<Common Name>.pfx"

If prompted, hit Enter to skip entering an export password.

Run certmgr.msc from the run prompt, start menu, or command line.

Open the Personal certificate store for the current user.

Right-click Certificates and click All Tasks > Import.

Make sure the Current User option is selected, then click Next.

Click Browse and select the <CommonName>.pfx file you created previously. You will have to change the file extension dropdown box from an X.509 Certificate to either Personal Information Exchange or to All Files in order to see it.

Select the file and click Open, and then Next.

Do not enter a password, and make sure that only the options Mark this key as exportable and Include all extended properties are selected.

Click Next.

Make sure that Place all certificates in the following store is selected, and that the certificate store listed is Personal. (If you’re an advanced user, you can select another store at this point, but you’ll have to change the configuration later.)

Click Next and then click Finish. You should see a dialog box telling you that the import was successful and see your certificate in the Certificates folder of the store.

Open the Insight.cfg file (located in the Insight installation directory).

Scroll down to the server entry that you wish to configure. If you wish to use the Windows Certificate store for every server, you have to make these modifications to every entry in the vector of serverInfo objects.

Add these parameters to their Insight.cfg file. You can do this from the workstation, or manually by adding the following parameters to the serverInfo object. (Be sure to use spaces instead of tab characters, and don’t make other typographical or syntax errors in this file. )

SSL Use CryptoAPI = bool: true
SSL CryptoAPI Cert Name = string: <Common Name>
SSL CryptoAPI Cert Issuer Name = string: Visual Sciences,LLC
SSL CryptoAPI Cert Store Name = string: My

The boolean enables or disables the feature. The certificate name matches Issuer To in the certificate manager. The certificate issuer name matches Issued By, and the Store Name must match the certificate store name.

A full list of the predefined system stores can be obtained here: https://msdn.microsoft.com/en-us/library/windows/desktop/aa388136(v=vs.85).aspx. Your system might have additional certificate stores. If you wish to use a store other than “Personal” (such as My), you must obtain the canonical name of the certificate store and provide it in the Insight.cfg file. (The system store name “My” is inconsistently referred to as “My” and “MY” by the Windows documentation. The parameter does not appear to be case sensitive.)

After you have added these parameters and verified that the values match the list in the Windows Certificate Manager, save the Insight.cfg file.