重要注意事项 An Important Note Before You Start

在生成CSR文件时同时生成您的私钥，如果您丢了私钥或忘了私钥密码，则颁发证书给您后不能安装成功！您必须重新生成私钥和CSR文件，免费重新颁发新的证书。为了避免此情况的发生，请在生成CSR后一定要备份私钥文件和记住私钥密码，最好是在收到证书之前不要再动服务器。
By far the most common problem users have when going through this process is related to private keys. If you lose or cannot access a private key, you cannot use the certificate we issue to you and will need to request a free reissue. To ensure this never happens, we advise that a backup of the private key file is made and that a note is made of the password that is used to protect the export of the private key.

To generate a CSR for IBM ICSS follow the instructions below:

If WoSign Root is not in IBM ICSS version 4.2.1, you need to install our root certificate before proceeding with your request. The root certificate contains the key that is used to verify the signatures on the certificates we issue. It is the same root that is embedded in Navigator and MSIE.

Step 1: Embed our Root Certificate

Download the WoSign Root file in a Text file from the following link : WoSign Root

Save it on your server hard drive.
Go to the Administration interface of your web server.
Underneath the "Security" configuration section of your server you will see a link called "Receive Certificate".
You will need to specify your current keyring file and pass phrase, and ask it to install the root certificate that you saved on your hard drive.

Step 2: Mark Thawte Root as a trusted Root

Under "Security" again you will see a link called "Key Management".
You will need to specify the key ring password.
Select "Designate Trusted Root Keys".
The Thawte root will be listed in X.400 format.
Select it, then press Apply.
The Thawte root is now a trusted CA for your server.

Step 3: Generate your own key and CSR

Go to the "Create Keys" link on the Admin page under "Security".
Choose "Other" as your CA.
On the next page, DO NOT GIVE A POSTAL CODE.
Specify your country as the two-letter code in UPPER CASE.
Give your full state name if you are in the USA.
Don't mail the certificate request to the CA, you are going to save it to a file instead.
Make a note where you saved it (the default is C:\WWW\Bin\CertReq.txt).
That file is what you paste into our forms - it is your CSR.

测试CSR和把CSR发给WoSign, Start the certificate request process

生成CSR后，建议您自己测试一下生成的CSR文件是否正确，请点击 这里 测试您的CSR文件。请把测试成功的CSR文件发给WoSign即可。请一定不要再动您的服务器，等待证书的颁发。
To submit the CSR to WoSign for processing you should start the certificate enrollment process.