Certificate creation/renewal procedure for WATS on premise servers

WATS WCF Certificates are issued with a validity period of 5 years, after expiration the certificates must be renewed to allow WCF Communication. Follow this guide to request and install a new certificate for your expired or expiring WATS on premise server.

This procedure must be performed on the WATS Application server

Download Certificate Request for WCF zip file from https://virinco.azureedge.net/public/resources/requestcert.zip

Unzip the archive and edit CertReq.inf with notepad or similar text editor. 

Change Customer, Sitename and Location to correct values. CN must be the same as the existing certificate for renewals. Save the file, and from an elevated command prompt run the following command:

certreq -new certreq.inf certreq.txt

Send the generated certreq.txt file to Virinco support (support@virinco.com)

When you receive the response file from Virinco (certnew.p7b)

Doble click certnew.p7b to open the file using certificate manager, then double click on VIC-Root certificate and click install Certificate. Import this certificate to the Local Machine's "Third-Party Root Certification Authorities" store.

After importing the root certificate, return to the elevated command prompt, and run the following commands:

certreq -accept certnew.p7b

Open certlm.msc (Manage Computer Certificates), and open Personal/Certificates

Delete old (expired) certificates from this store, and make sure only one certificate exists with the specified CN

Give network service access rights to the private key by running this command (can also be done in Certificates UI):

winhttpcertcfg.exe -g -c LOCAL_MACHINE\My -s "sitename.customer.wats.no" -a "NETWORK SERVICE"

 (replace "sitename.customer.wats.no" with the CN specified in certreq.inf)

Extract the new certificate to the website by right-clicking the new certificate in certlm and select All Tasks>Export...

do not export the private key, export as PKCS #7 and check "include all certificates in the certification path if possible". Export the p7b file to webroot/wats-dc/certificates.p7b - usually located in C:\ProgramData\Virinco\WATS\WATS\wwwroot\wats-dc