ADP Workforce Now – How do I generate a certificate signing request?

Complete the following steps to generate the certificate

Manual Process Steps (Client Process Steps)

To complete a Certificate Signing Request, do the following:

1. Download OpenSSL Light for Windows at: http://slproweb.com/products/Win32OpenSSL.html.
   NOTE: Mac users can open Terminal and jump to the OpenSSL commands in Step 5. 

2. To install OpenSSL, follow the instructions in the Install Wizard.

3. Open cmd.exe.

4. Go to the location where you installed OpenSSL and at the command line, type:
   cd C:\Program Files (x86)\OpenSSL-Win32\bin (or C:\Program Files\OpenSSL-Win64\bin for 64-bit).

5. Generate the CSR:

   • openssl genrsa -out companyname_auth.key 2048

   • openssl req -new -key companyname_auth.key -out companyname_auth.csr

Your CSR must not request S/MIME capabilities.

6. Enter the following information into your CSR. Leave the Country Name, State or Province Name, Locality Name, and Challenge Password fields blank.

   • Organization Name: This MUST be the same string used by your organization when registered with ADP

   • Common Name: This is the company name. Please include “MutualSSL” after the company name. Do not use any special characters. Example:  ABCCompanyMutualSSL

7. After you have created your CSR, follow these steps to submit your request directly to ADP Security Services:

   • Open the ADP Certificate Signing Tool (no login is required).

   • Choose Authentication and Transaction Signing for the certificate type.

   • Enter your technical contact’s email.

   • Enter your company name and ADP client ID.
     NOTE: If you are an ADP Workforce Now client, your ADP client ID is all the characters to the right of the @ symbol in your ADP Workforce Now login name. If you don't know your ADP client ID, contact your ADP representative.  

   • Enter your technical contact’s first and last name and a group distribution email to be notified when the generated certificate is reaching its two-year expiration date.

   • Paste the complete contents (including BEGIN CERTIFICATE REQUEST and END CERTIFICATE REQUEST) of your CSR into the CSR text box.
      

8. Save the signed certificate from ADP into a file named companyname_auth.pem in the same location that you initially created the CSR (C:\Program Files (x86)\OpenSSL-Win32\bin).

9. If you are using Windows/IIS, use the following command to get the key and certificate in PKCS12 format: 

openssl pkcs12 -export -out "c:\cert_path\companyname_auth.pfx" -name "Company Name Mutual SSL" -inkey "c:\cert_path\companyname_auth.key" -in  "c:\cert_path\companyname_auth.pem"

1. Enter the Export Password.

2. Verify the Export Password.

The resulting PFX formatted certificate file will be found in the c:\cert_path folder; companyname_auth.pfx is the file you'll reference for Mutual SSL authentication in the Windows/IIS configuration.

Make sure you safeguard the .key, .pfx, and .jks files. Anyone that possesses these confidential files has access to the web service.