Windows CA – How to Create a Device Certificate

On your server with the Certificate Authority installed, run certsrv.msc.

Ensure the server tree is expanded, Right-click Certificate Templates, and click Manage.

The Certificate Templates Console opens. 

Right-click on the Computer template, and click Duplicate Template.

Under the General tab, give the Template a new but related name, like Computer-2. You can modify any settings you need as well, such as making the private key exportable.

Click Ok when done.

Now the Template will not show immediately in the Certsrv. To make it show up, first Right-Click the server name in Certsrv, and click Stop Service. Once stopped, Right-Click the server name again and click Start Service.

Now Right-Click Certificate Templates, hover over New, and click Certificate Template to Issue. It may take a minute, but a new dialog will appear.

Click the new Template you created and click Ok.

Now, from the PC you need to create the device cert on, open mmc.exe and add the Certificates Snapin for the Computer account.

Expand Certificates. Right-click Personal. Click Request New Certificate. Click Next Twice, so you are at the screen to select the Cert Template to request the cert for. Check the one with the name you selected from the prior step, and Click Enroll.

The device cert will be created, and if you expand Personal, click on Certificates, you will see the certificate.