title: How to generate an SSL client certificate from a disconnected network?
body: <p>I have a unique situation where I need to implement client certificate authentication over HTTPS between IE browser and IIS 6.  The browser and IIS are separated by a firewall that only allows the browser to connect to IIS on the SSL port.</p>
  
  <p>We have an internal certificate server on the same network as IIS.  I've generated an SSL server cert for IIS and that is installed.  I configured IIS to only allow SSL, require client certificates.</p>
  
  <p>The limitation here is the browser machine is on a disconnected network, so I can't go to the CA's <a href="http://caserver/CertSrv" rel="noreferrer">http://caserver/CertSrv</a> URL and <a href="http://www.windowsecurity.com/articles/Client-Certificate-Authentication-IIS6.html" rel="noreferrer">request a client cert</a> like you normally would.</p>
  
  <p>I figured if there were a way that I could generate a CSR against the Root CA's public key, I can copy it to the CA server to generate the client cert.  But, there appears to be no provision in IE or the Certificates MMC to do this.  The Certificates MMC seems to require a direct connection to the CA.</p>
  
  <p>Has anyone solved this before?</p>
  
  <p>FYI, All servers referenced run Windows Server 2003.</p>
  
  <p><strong>Update:</strong> Thanks to Jonas Oberschweiber and Mark Sutton for pointing out the CertReq.exe command line tool.  Using this, I've generated a CSR, and consequently a client certificate that installs successfully.  However, IE is apparently not sending this client cert when accessing the IIS server in question; it still generates a 403.7 "Forbidden: SSL client certificate is required."  I suspect that the reason is that the Subject field of the client cert does not match the user id of the account running IE, thus perhaps not sending a mismatching client cert.  The Subject matches that of the user I used to submit the CSR and generate the client cert on the other end of the firewall.</p>
  
  <p>Does the Subject field matter?  Is there something else I need to do to enable IE to send this cert?</p>