You’ll create a Certificate Signing Request, submit it to ADP, and save the signed certificate for your connection.
Create Your Certificate Signing Request
Windows users
Download and install OpenSSL Light for Windows, then open Command Prompt.
Navigate to your OpenSSL installation:
cd C:\Program Files (x86)\OpenSSL-Win32\binFor 64-bit installations:
cd C:\Program Files\OpenSSL-Win64\binGenerate your private key and Certificate Signing Request:
openssl genrsa -out companyname_auth.key 2048
openssl req -new -key companyname_auth.key -out companyname_auth.csrMac users
Open Terminal and use the same OpenSSL commands above.
When prompted, enter:
| Organization Name | Use the exact organization name registered with ADP. |
| Common Name | Enter your company name followed by MutualSSL, with no special characters. Example: ABCCompanyMutualSSL |
| Country Name, State or Province Name, Locality Name, and Challenge Password | Leave these fields blank. |
Your CSR should not request S/MIME capabilities.
Submit Your Request to ADP
Open the ADP Certificate Signing Tool. No login is required.
Select Authentication and Transaction Signing as the certificate type, then provide:
- Your technical contact’s name and email
- Your company name
- Your ADP Client ID
- A group email address for certificate expiration notifications
- The complete contents of your CSR, including BEGIN CERTIFICATE REQUEST and END CERTIFICATE REQUEST
Save Your Signed Certificate
Once ADP provides the signed certificate, save it as:
companyname_auth.pemSave it in the same location where you created your CSR.
Using Windows/IIS?
Convert the certificate to PKCS12 format using OpenSSL and create your export password when prompted. The resulting file will be:
companyname_auth.pfxThis is the certificate file used for Mutual SSL authentication in your Windows/IIS configuration.
Important
Keep your certificate files secure, including your:
.key.pfx.jks
Anyone with access to these files could access the web service.