IAM(Identity Access Management) through OIM, OVD, ODSEE, Saviynt: 2019

Monday, September 23, 2019

OIM upgrade from 11G R2 PS1 to 11G R2 PS3 (11.1.2.1.0 - 11.1.2.3.0)

The posts to be followed will elaborate on the path to be followed for updating to OIM 11GR2PS3 version for your existing system (from 11.1.2.x.x).
There are simply too many tasks involved, so I decided it'll be better to break it up to shorter steps, each focusing on a single task and each to be followed in the same sequence.

Do not use this posts if the OIM deployment was done with Oracle LCM tools.

ROADMAP :

STEP 1 - Pre-Upgrade tasks :

1.a : Take complete backups of the servers and all the database schema , this upgrade do not come with a roll-back process, so make sure to have backups of the MW_HOME, Domain_Home, and the DB schema.
1.b : Check the system and product compatibilities
Read more about it here
note : make sure all the relevant OS packages are present, upgrade jdk version if required, also pay attention separaetly to the OUI , RCU , and DB requirements.

1.c : Run and verify the pre-upgrade report utility
Read more about it here : Generating the Pre-Upgrade Report

1.d : Download the softwares :
OIM 11GR2PS3 : Patch 20996201
Latest OIM Bundle patch : Doc ID 2031368.1[at the moment, it is patch 29347961] (16-aor-2019)
SOA Suite 11g Patch Set 7 (11.1.1.9) : Patch 20995651
SOA Suite 11g Bundle Patches : Doc ID 1641787.1
Weblogic Server 10.3.6 : Patch 13529623
RCU 11.1.1.9 : Patch 20996068
JAVA 1.7.0_80 : JAVA Archive
Oracle Identity Manager 11gR2 PS3 (11.1.2.3) Upgrade Advisor ( Doc ID 2002373.2 )

STEP 2 - Update OPatch :

Oracle says 'OPatch used must be an 11.1.0.x patch of version 11.1.0.10.3 or higher to complete successfully.
Testing in lab with the current version available under Patch 6880880 as of March 2016 leads to successful upgrade'.

To correctly update OPatch utility and update the Central Inventory with this information, the following steps are needed(Doc ID 2046456.1).

1. Download the 11.1.0.0.0 version of Patch 6880880 and save it to the $ORACLE_HOME.
2. Rename the existing OPatch directory to OPatch.orig, or if preferred remove it.
3. Unzip the newer OPatch archive file directly in the ORACLE_HOME. This creates a new OPatch directory.
4. Change directory to this new OPatch directory. Example: cd OPatch
5. New Step: Run the command ./opatch util UpdateOPatchVersion

6. Run the command ./opatch version and ensure it is the version expected.

STEP 3 - Upgrade weblogic to 10.3.6.0 :

In this environment, the webLogic was already in the required version, hence I skipped the step, but if required, you can always refer to :
Upgrading to WebLogic Server 10.3.6.0

STEP 4 - Upgrade SOA binaries to 11.1.1.9.0 (to both SOA_HOST1 and SOA_HOST2) :

check the SOA version : oracle_SOA home> bin > soaversion.sh

Make sure all Edit sessions in SOA Composer are committed or reverted.

Log in to the SOA Composer (/soa/composer) as any user with active sessions.
Go to Open > My Edits to view all of your active sessions.
Open each document listed in "My Edits" and do one of the following:

Click Commit to commit the session changes.
Select Revert > Clear all session edits and saved changes to abort the changes.

Stop the soa managed servers.
CD to Disk1 and ./runInstaller , if prompted , provide the java_home if it's not defined in env or mention in the command itself ./runInstaller -jreloc java_home.

Provide your middleware home and soa oracle home when prompted for, and complete the following steps.
once done, set Oracle home env variable to soa oracle home and check with ./opatch lsinventory , the soa version should be 11.1.1.9.0.

STEP 5 - Upgrade OIM binaries to (11.1.2.3.0)(to both OIM_HOST1 and OIM_HOST2) :

Stop the oim managed servers.
Follow the steps same as mentioned in step 3 , and copy the new binaries to oim oracle home.

check the installer logs at the following location:
On UNIX: ORACLE_INVENTORY_LOCATION/log
To find the location of the Oracle Inventory directory on UNIX, check the file ORACLE_HOME/oraInst.loc.

NOTES : Oracle highly recommends to apply patch 24615124 at this point, prior to doing the Schema upgrade. This addresses large tables issues.

STEP 6 - Upgrade existing OIM and SOA schema or create new BI Publisher and OPSS schema :

OIM PS3 comes with embedded BI Publisher , so it's important we create the BIPUBLISHER and MDS schema for the new BIP . Follow the step 2 here :
http://bitoshok-das.blogspot.com/2019/09/bi-publisher-111190-standalone.html

Once the BIP schemas are created , update the below existing schemas with Patch-Set assistant(PSA) :

Oracle Platform Security Services (OPSS) schema
Metadata Services (MDS) schema
Oracle Identity Manager (OIM) schema
ORASDPM schema
SOA Infrastructure (SOAINFRA) schema

Check the schema versions pre and post update to verify :
SELECT OWNER, VERSION, STATUS, UPGRADED FROM SCHEMA_VERSION_REGISTRY where owner=<SCHEMA_NAME>;

run the PSA : cd to <MW_HOME>/oracle_common/bin > ./psa

Screen	Description
Welcome	This page introduces you to the Patch Set Assistant.
Select Component	Select the component you wish to upgrade.
Prerequisite	Verify that you have satisfied the database prerequisites.
Schema	Specify your database credentials to connect to your database, then select the schema you want to update.
	Note that this screen appears once for each schema that must be updated as a result of the component you selected on the Select Component screen.
Examine	This page displays the status of the Patch Set Assistant as it examines each component schema. Verify that your schemas have a "successful" indicator in the Status column.
Upgrade Summary	Verify that the schemas are the ones you want to upgrade.
Upgrade Progress	This screen shows the progress of the schema upgrade.
Upgrade Success	Once the upgrade is successful, you get this screen.

Middle tier upgrade is performed using the OIMUpgrade.sh utility. Oracle Identity Manager middle tier upgrade is carried out in two stages and both are mandate :

1. Middle tier upgrade offline : This is the first stage where OIMUpgrade.sh is run in offline mode, that is, with the Administration Server and the Managed Server(s) in shutdown state.

2. Middle tier upgrade online : This is the second stage where OIMUpgrade.sh is run in online mode, that is with the Administration Server and the SOA Managed Server(s) in running state, OIM and BIP managed server in shutdown stage.

STEP 7 - Upgrade Oracle Identity Manager middle tier in offline mode on OIM_HOST1 :

7.a : Creating a Truststore for Upgrading SSL Enabled Middleware

To create a truststore, complete the following steps:
Export the public certificate from the identity store for each server, and place all of them in a single directory.
Import all of the public certificates to a single truststore.
Copy the truststore to a location accessible by upgrade script.
Specify the truststore location and type for the properties wls.trustStore.loc and wls.trustStore.type respectively, when updating the properties file.

7.b : Updating the Properties File :

Upfate the oim_upgrade_input.properties file loacted under ORACLE_OIM_HOME/server/bin/ directory as explained here :
Parameters to be specified in the Properties File

7.c : run the OIMUpgrade utility in offline mode
Make sure that you have stopped the WebLogic Administration Server, the Oracle Identity Manager Managed Server(s), and the ALL the Managed Server(s).

cd to OIM_ORACLE_HOME/server/bin > ./OIMUpgrade.sh offline

Provide the OIM, MDS, SOA, BIP, OPSS schema passwords.

Check the HTML reports generated at ORACLE_HOME/server/upgrade/logs/MT/oimUpgradeReportDir_offline.

Check the logs files generated at ORACLE_HOME/server/upgrade/logs/MT/ to verify if the middle tier offline upgrade was successful.

-----------------------------------------------------------------
If you do NOT have high availability oim set up with multi node, you may jump to step 8, if not, execute the following steps :

Replicate the domain configuration on OIM_HOST2 by packing the upgraded domain on OIM_HOST1 and unpacking it on OIM_HOST2 :

cd to $MW_HOME/oracle_common/common/bin

on oim_server1
sh pack.sh -domain=<Location_of_OIM_domain> -template=<Location_where_domain_configuration_jar_to_be_created> -template_name="OIM Domain" -managed=true

Copy the jar created on oim_server2 :
sh unpack.sh -domain=<Location_of_OIM_domain> -template=<Location_on_OIM_HOST2_where _you_copied_jar_file_created_by_pack_command> -overwrite_domain=true

After you unpack the domain, copy the content of the following directory on OIM_HOST1 to the same directory on OIM_HOST2:
DOMAIN_HOME/soa/autodeploy
----------------------------------------------------------------

STEP 8 - Upgrade Oracle Identity Manager middle tier in online mode ONLY on OIM_HOST1 :

start the WebLogic Administration Server and the SOA Managed Server(s)

cd to OIM_ORACLE_HOME/server/bin > ./OIMUpgrade.sh online

Check the HTML reports generated at ORACLE_HOME/server/upgrade/logs/MT/oimUpgradeReportDir_online

After you upgrade the Oracle Identity Manager middle tier online, you must start the Oracle Identity Manager Managed Server (s) and the BIP Server.
-----------------------------------------------------------------
Before starting the servers, you must add the following property below the JAVA_PROPERTIES entry in the

DOMAIN_HOME/bin/setDomainEnv.sh, to ignore hostname verification:
-Dweblogic.security.SSL.ignoreHostnameVerification=true

When we start the Managed Servers for the first time after middle tier upgrade, the servers must be connected to the non-SSL Administration Server port. To do this, complete the following steps:

Before we start the Managed Servers, enable the non-SSL port for the Administration Server :

Ensure that the Managed Servers connect to the non-SSL admin port while starting. For example, if managed server is started using startManagedWebLogic.sh script, update the ADMIN_URL in this script to use the non SSL url.
These changes can be reverted back once the servers are up.
------------------------------------------------------------------

8.a: Changing the Deployment Order of Oracle Identity Manager EAR

1. Log in to the WebLogic Administration console and Click Deployments on the left pane.

2. Click oim.ear and update the deployment order from 47 to 48.

NOTES : Oracle highly recommends to apply the latest bundle patch (patch 29347961 at the moment),

Stop the Admin Server, all Oracle Identity Manager managed servers, and all SOA managed servers
Download the patch p29347961_111230_Generic.zip file, unzip it, set oracle-home env var to Oraclie_OIM_Home, cd to Oraclie_OIM_Home/OPatch and apply the patch

./opatch apply ../29347961/iamsuite/patch/oim/29551893

If OPatch fails with error code 104, cannot find a valid oraInst.loc file to locate Central Inventory, include the -invPtrLoc argument, as follows:
opatch apply -invPtrLoc ORACLE_HOME/oraInst.loc

After patch is applied, Oracle Identity Manager server staging directories must be deleted. To do so,

remove cache/*, stage/*, and tmp/* directories
cd to DOMAIN_HOME/servers/OIM_SERVER_NAME
rm -Rf cache/* stage/* tmp/*

cd to OIM_ORACLE_HOME/server/bin/ directory, and enter the details provided in the patch_oim_wls.profile file.

Make sure that the WebLogic Admin Server, SOA Managed Servers, and Oracle Identity Manager Managed Server are running.

Set the following environment variables:
setenv PATH $JAVA_HOME/bin:$PATH

Execute patch_oim_wls.sh to apply the configuration changes to the Oracle Identity Manager server. We must run the script in a shell environment using the following command:

sh patch_oim_wls.sh

Note: This script needs to be run on each OIM managed nodes while the servers are up.

Delete the following directory in domain home:
IDM_DOMAIN/servers/OIM_SERVER_NAME/tmp/_WL_user/oracle.iam.console.identity.self-service.ear_V2.0

To verify that the patch_oim_wls script has completed successfully, check the OIM_HOME/server/bin/patch_oim_wls.log log file.

Stop and start WebLogic Admin Server, SOA Servers, and Oracle Identity Manager Servers.
------------------------------------------------------------------
Note :
On running the patch_oim_wls script, the $DOMAIN_HOME/servers/MANAGED_SERVER/security/boot.properties file might be deleted. If you use a script to start the Managed Server and use the boot.properties file to eliminate the need of entering the password in the script, then create a new boot.properties file.

Ignore the following exception traces in the patch_oim_wls.log file:
[java] Aug 11, 2015 3:45:28 AM oracle.jdbc.driver.OracleDriver registerMBeans
[java] WARNING: Error while registering Oracle JDBC Diagnosability MBean.
[java] java.security.AccessControlException: access denied (javax.management.MBeanTrustPermission register)
[java] at java.security.AccessControlContext.checkPermission(AccessControlContext.java:374)
------------------------------------------------------------------

STEP 9 - Upgrade OIM Design console :

cd to OIM_ORACLE_HOME/bin > ./config.sh and on the components to configure screen, select only "OIM Design Console"
Provide OIM server hosts and port names and complete the next steps.

Once done,run the following command to build the wlfullclient.jar file:

java -jar <MW_HOME>/modules/com.bea.core.jarbuilder_1.7.0.0.jar

Copy the wlfullclient.jar file to the <IAM_HOME> where you installed the Design Console. For example:
cp wlfullclient.jar <Oracle_IDM>/designconsole/ext

If the Design Console is SSL enabled, do the following :

Copy the webserviceclient+ssl.jar file from the directory WL_HOME/server/lib/ to the directory ORACLE_HOME/designconsole/ext/.
Copy the cryptoj.jar file from the directory MW_HOME/modules/ to the directory ORACLE_HOME/designconsole/ext/.

If DESIGN_CONSOLE_HOME/config/xl.policy does not contain the default grant policy for all, then add the following permission for cryptoj.jar at the end of the xl.policy file:

grant codeBase "file:DIRECTORY_PATH_TO_cryptoj.jar"{permission java.security.AllPermission;};

Open the xlclient.sh file (located at XLDC_HOME/xlclient.sh, and add the following argument to the java command:
-DAPPSERVER_TYPE=wls

Restore the xlclient.sh , xlconfig.xml files.

STEP 10 - Post-Upgrade tasks :

Please refer below for all the post-upgrade activities, not all of them may be relevant for your environment though :
OIM Post-Upgrade Tasks

STEP 11 - Verify if the upgrade is successful or not by:

checking through ./opatch lsinventory
checking if the sefl-service portal and sysadmin portals are up and running.
checking if the BI Publisher is up and running on :
http://bip_host:bip_port/xmlpserver

STEP 12 :

Grab one iced-cofee and enjoy ! you earned it .

As always, thank you for reading.

Friday, September 20, 2019

BI Publisher (11.1.1.9.0) standalone installation

The below post will walk you through to install Oracle BI Publisher.

I'm assuming you already have JAVA and Weblogic installed. Also, please refer to the links section at the bottom of this post for all the software downloads.

so without further ado -

STEP 1 : Download BIP binaries
STEP 2 :
2.a Download RCU

2.b Edit /rcuHome/bin/rcu script to declare JRE_DIR=$JAVA_HOME/jre
2.c Run ./rcu

STEP 3 :
3.a unzip the BI publisher binary zip files downloaded in step 1.
3.b run the ./runInstaller script in /bishiphome/Disk1/

We'll do a software install only in this instance, and run the configure.sh separately for configuring the domain.
You may try the "Enterprise Install" option where you'll get option to configure the new domain at the same go.

STEP 4 : Create and Configure a new weblogic domain
move to MW_HOME/Oracle_BI1/bin (or any other Oracle BIP home name you've specified in step 2) and execute config.sh.

Important :
If you're installing BIP to be sued with OIM as I am, it's very important that you only configuer the BI Publisher and not the other products from the OBIEE suite, other wise the BIP portal will be up and running but reports will not be visible as below [reference (Doc ID 2426660.1)].

screenshots for config.sh :

select only BI Publisher

STEP 5 : commom ERRORS encountered

Since the we configuered the new domain with the "auto port configuration" option, check and modify the ports if required or already in use in the MW_Home/user_projects/domains/bifoundation_domain/config/config.xml file.

CD to ../servers/serverName/ and clear the rm -Rf cache/* data/* tmp/*

Since this is the first time, move to /security and check if the boot.properties is there, if not create it as below for both the Admin and Managed bi_server1 :

password=************
username=weblogic

Start the BI Admin and Managed servers from ../bifoundation_domain/bin path.

Check if the "xmlpserver" is deployed and in Active stage named as bi_publisher with deployment order 510 in the deployment section of the weblogic admin console, if not, redeploy.

While deploying, if you face library missing errors as below :

Error [J2EE:160149]Error while processing library references. Unresolved application library references, defined in weblogic-application.xml: [Extension-Name: adf.oracle.domain, exact-match: false], [Extension-Name: oracle.jsp.next, exact-match: false], [Extension-Name: bijdbc, exact-match: false], [Extension-Name: oracle.ess, exact-match: false], [Extension-Name: oracle.applcore.model, exact-match: false].

check the missing library references in the ../bifoundation_domain/config/config.xml file source Path attribute , and deploy the libraries in the bi_server1.

If the BIP portal comes up , and everything seems proper, jump to step 6 , else if you see the below error after logging in :

Locate the 'xmlp-server-config.xml' file in the path ..//bifoundation_domain/config/bipublisher and overwrite the file :

<?xml version = '1.0' encoding = 'UTF-8'?>
<xmlpConfig xmlns="http://xmlns.oracle.com/oxp/xmlp">
<resource>
<file path="../bifoundation_domain/config/bipublisher/repository"/>
#mention your own file based repository path.
</resource>
<config>
<file path="${xdo.server.config.dir}/repository"/>
</config>
</xmlpConfig>

If you see the "Administration" tab missing in the BIP portal once you loginto with weblogic user password, do the following :

1.Log into Fusion Middleware Control, navigate to Security, then select Application
Roles to display the Application Roles page.
2. Choose Select Application Stripe to Search, then select the obi from the list. Click
the search icon next to Role Name.
3. Select the cell next to the application role name and click Edit to display the Edit
Application Role page.
You can add or delete members from the Edit Application Role page. Valid
members are application roles, groups, and users.

STEP 6 :

Copy the ../OIM_Oracle_Home/server/reports/oim_product_BIP11gReports_11_1_2_1_0.zip file, and unzip it under ../bifoundation_domain/config/bipublisher/repository/Reports path.

no server restart is required, log into the bip portal http://host:port/xmlpserver and you'll be able to see this new OIM OOTB templates unser catalog/shared folders.

Important Links :

Oracle Fusion Middleware Download, Installation, and Configuration ReadMe Files

BI Publisher binaries :
https://www.oracle.com/middleware/technologies/bi-downloads.html
RCU :
Patch 20996068: ORACLE FUSION MIDDLEWARE REPOSITORY CREATION UTILITY 11G (11.1.1.9.0)

Library :
https://www.oracle.com/technetwork/middleware/bi-foundation/documentation/bi-pub-096318.html

Tuesday, August 6, 2019

AD .NET windows connector server certificate upgrade using OpnSSL, Certutil, MMC console

In our current set-up we've a .NET connector server for communication between AD and OIM which is running on Windows 64, for which we'll renew the server certificates.

Please go through the complete post cause there are multiple fronts to this.

STEP 1 : Generate a new certificate :

Now, generate a new CSR and a private key using OPENSSL commands :

openssl req -nodes -newkey rsa:2048 -sha256 -keyout private.key -out server.csr

similarly as CSRs generated by keytool utility, you need to align with your CA authority for getting the .cer certificate filegenerated from the above csr file.

STEP 2 Find the Certificate store :

If you're configuring a new connector server :

Run the following command from the command prompt:

ConnectorServer.exe /setkey NEW_KEY

This key is used for SSL communication by any client that connects to this .NET Connector Server, you will also need to update this key in the connector server IT resource along with the other properties.

Open the C:\Program Files (x86)\Identity Connectors\Connector Server\ConnectorServer.exe.Config file for the entry :

<add key="connectorserver.port" value="8759" />
<add key="connectorserver.usessl" value="true" />
<add key="connectorserver.certificatestorename" value="ConnectorServerSSLCertificate"/>

The certificate store mentioned in the ConnectorServer.exe.Config file must have only one certificate. If there is more than one certificates, then the .NET Connector Server will not start.
Run the following command to view the number of certificates present in the certificate store:

C:\>certutil -viewstoreSTORE_NAME

This will give you a certificate pop-up where you can check if the certiifctae is valid or not.

STEP 3 : Create a new certificate store or delete the certiifcate from the old store :

For creating a new certiifcate store use :

certutil -f -addstore sslstore2019 C:\*****.cer

For verifying a store :

certutil -verifystore sslstore2017

For deleting a certificate from an existing store :

certutil -v -delstore Certificate _FQDN

We can cehck the new store from windows MMC console :

Log on to the computer that issued the certificate request by using an account that has administrative permissions.
Click Start, click Run, type mmc, and then click OK.
On the File menu, click
Add/Remove Snap-in.
In the Add/Remove Snap-in dialog box, click Add.
Click Certificates, and then click
Add.
In the Certificates snap-in dialog box, click Computer account, and then click
Next.
In the Select Computer dialog box, click Local computer: (the computer this console is running on), and then click Finish.
Click Close, and then click OK.

STEP 4 Merge the private key and certificate :

For a proper ssl handshake, the server is required to have a private key paired with the public key embedded in the certificate. When a client connects, it is presented with the certificate. This allows for validation that the server is who it says it is based on trust of an issuance authority.
The certificate needs to have private key in order to decrypt the data from OIM, or you'll receive the error : "The server mode SSL must use a certificate with
the associated private key".

ConnectorServer.exe	Error	0	Error processing request 
The server mode SSL must use a certificate with the associated private key. 
at Boolean AcquireServerCredentials(Byte[] ByRef) 
at System.Net.SecurityStatus GenerateToken(Byte[], Int32, Int32, Byte[] ByRef) 
at Void ProcessAuthentication(System.Net.LazyAsyncResult) 
at Void Run() in Server.cs:793

To avoid it, run the below command on windows server :

openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile more.crt

Breaking down the command:

openssl – the command for executing OpenSSL
pkcs12 – the file utility for PKCS#12 files in OpenSSL
-export -out certificate.pfx – export and save the PFX file as certificate.pfx
-inkey privateKey.key – use the private key file privateKey.key as the private key to combine with the certificate.
-in certificate.crt – use certificate.crt as the certificate the private key will be combined with.
-certfile more.crt – This is optional, this is if you have any additional certificates you would like to include in the PFX file.

This will ask you for a password fpr the private key.

If you get the below ERROR : make sure you're using the right key-cer pair, and not the old key file.
No certificate matches private key

If you get the below ERROR : make sure the certificate was created by CA using base-64 encoded.cer format, and not a DER encoded .cer file.
unable to load certificate

Solution : Import the certificate through MMC console as it is , and then export it to a base-64 encoded.cer format.

STEP 5 : Merge the new .pfx file in to your Personal console and Certificate store used in ConnectorServer.exe.Config file.

In the Certificates snap-in, expand
Certificates, right-click the Personalfolder, point to All Tasks, and then click Import.
On the Welcome to the Certificate Import Wizard page, click Next.
On the File to Import page, click Browse.
In the Open dialog box, click the new certificate, click Open, and then click Next.
On the Certificate Store page, click
Place all certificates in the following store, and then click Browse.
In the Select Certificate Store dialog box, click Personal, click OK, click
Next, and then click Finish.

STEP 6 : Import the same certs into all the oim managed server cacerts using keytool -import command.

ISSUES :

Let's say you've lost the provate key of the cert file, so you can't merge it with a cer file in STEP 4 , for a temporary solution run this :

certutil -repairstore my "SerialNumber"

my :Is the name for 'Personal' store, you can use other certificate store names as well.
SerialNumber : can be found under the certificate details tab.

You'll get an output like :

================ Certificate 0 ================
Serial Number: 1f000240eb44e292465b2943y86b0000240eb
Issuer: CN=xxxx-SUBCA, DC=xxxxnet, DC=xxxx, DC=intranet
NotBefore: 24/10/2017 10:52
NotAfter: 24/10/2019 10:52
Subject: E=layerauth.admin@xxxx.com, CN=sasv02om.xxxxnet.xxxx.intranet, OU
=ICT, O=xxxx S.p.A, L=San Donato Milanese, S=Milan, C=IT
Non-root Certificate
Template: xxxx-WebServer-v2
Cert Hash(sha1): 01 f2 cb be 69 7a a3 ee 64 44 02 c7 44 07 4b ee 1b 23 99 0e
  Key Container = {54F11DE4-608E-4448-88B9-F411EA9A51B3}
  Unique container name: c99573d8960fcfecd7f2969646d4cd2a_f7356bcf-b93a-44b7-94e
e-a9dad59422ba
  Provider = Microsoft Enhanced Cryptographic Provider v1.0
Private key is NOT exportable
Encryption test passed
CertUtil: -repairstore command completed successfully.

How to make sure your certificate has the private key attached with it ?

You'll get the bellow message displayed in the certificate "General" tab :

What if I had created my CRS using Certutil and not OpnSSL ?

The following syntax is used for certutil:

certutil –MergePFX certfile.cer certfile.pfx

Since there is no way to specify private key file for –MergePFX parameter you must consider the following requirements:

Private key file MUST have .KEY extension;
certificate and private key files MUST have the same base file name (file name excluding extension);
certificate and private key file must be placed in the same directory.

How to get OpenSSL in my Windows server :

ownload it from here :

OpenSSL.org – Binary Distributions

https://wiki.openssl.org/index.php/Binaries

unzip and keep the binarys as well as your .key and .cer file in the same folder where you'll execute the STEP 4.

Now, I'm definetly no expert on openSSL (doing it for the first time) so here's a few good read to refer to in future :