HomInv LAN SSL

Go to any server which has IIS installed
Create and save the below lanssl1.inf

lanssl1.inf (Gateway.HomInv)

[Version]
Signature="$Windows NT$"

[NewRequest]
Subject = "CN=apis.hominv.aspireclan.com, O=Aspireclan, L=Rockaway, S=NJ, C=US"
KeySpec = 1
KeyLength = 2048 
Exportable = TRUE
MachineKeySet = TRUE
SMIME = False
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0

[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1 ; Server Authentication

[Extensions]
2.5.29.17 = "{text}"
_continue_ = "dns=*.apis.hominv.aspireclan.com"

lanssl1.inf will cover 9 URLs : →
prod-app-01.apis.hominv
qa-app-01.apis.hominv
dev-app-01.apis.hominv
prod-in-prxy-01.apis.hominv
qa-in-prxy-01.apis.hominv
dev-in-prxy-01.apis.hominv
prod-lb-01.apis.hominv
qa-lb-01.apis.hominv
dev-lb-01.apis.hominv

Create and save the below lanssl2.inf

lanssl2.inf (Service.HomInv)

[Version]
Signature="$Windows NT$"

[NewRequest]
Subject = "CN=hominv.aspireclan.com, O=Aspireclan, L=Rockaway, S=NJ, C=US"
KeySpec = 1
KeyLength = 2048 
Exportable = TRUE
MachineKeySet = TRUE
SMIME = False
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0

[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1 ; Server Authentication

[Extensions]
2.5.29.17 = "{text}"
_continue_ = "dns=*.auth.hominv.aspireclan.com&"
_continue_ = "dns=*.data.hominv.aspireclan.com&"
_continue_ = "dns=*.file.hominv.aspireclan.com&"
_continue_ = "dns=*.script.hominv.aspireclan.com"

lanssl2.inf will cover 12 URLs : →
prod-app-01.auth.hominv
prod-app-01.data.hominv
prod-app-01.file.hominv
prod-app-01.script.hominv
qa-app-01.auth.hominv
qa-app-01.data.hominv
qa-app-01.file.hominv
qa-app-01.script.hominv
dev-app-01.auth.hominv
dev-app-01.data.hominv
dev-app-01.file.hominv
dev-app-01.script.hominv

Open windows powershell with Admin privilege
Go to the folder where the full.inf is placed
Execute the commands →

certreq -new lanssl1.inf lanssl1.csr

certreq -new lanssl2.inf lanssl2.csr

The above command will generate a Certificate request file (full.csr)
Open the full.csr in Notepad++ and copy the entire content
Access https://cert.aspireclan.com/certsrv/ from the server and authenticate using domain admin username and password
Click on Request a Certificate link
Click advanced certificate request
Paste the content copied from full.csr in the field Base-64-encoded certificate request(CMC or PKCS #10 or PKCS #7):
Select the certificate template Hom Inv Wildcard SSL Certificate
Click Submit
Select Base 64 encoded option
Click Download certificate
Go to IIS and use the "Complete Certificate Request" wizard to import the certificate you received from the CA.
Browse to the .crt file provided by the CA and give it a friendly name for easy identification. Select Certificate Store: WebHosting
Verify the Private Key Association
After completing the certificate request, check if the certificate shows up with a key symbol in the MMC snap-in for Certificates under the Web Hosting store, under Local Computer Certificates. This indicates the private key is correctly associated.
Exporting the Certificate with the Private Key for installing in other servers/machines
In the MMC Certificates snap-in [Certifiates (Local Computer) → Web Hosting → Certificates], right-click the certificate, choose All Tasks, and then Export.
Follow the wizard to export the certificate, making sure to include the private key, and choose a password (below) to protect the exported file.

cert@aspireclan123#

Importing to the Target Server
Transfer the exported .pfx file to the target server.
In IIS Manager on the target server, use the "Complete Certificate Request" wizard to import the .pfx file.
When prompted, provide the password you set during the export process.

Root CA Certificate in client machine and postman

Go to Home in https://cert.aspireclan.com/certsrv/ from the server and authenticate using domain admin username and password
Click Download a CA certificate
Select Current[aspireclan-PROD-CERT-01-CA] option from CA Certificate listbox
Select Encoding method: Base 64
Click Download CA certificate
Install the CA certificate in AM-PC or any other machine where the websites will be accessed
Intall location Local Computer Account → Trusted Root Certification Authorities