Use the X.509 Certificate Options page to configure certificate mapping and revocation options.

Certificate mappings

Certificates may be mapped to the user in the same way the pure RSA/DSA keys are mapped under SSH.  The public key associated with the X.509 may be placed in the authorized keys file to establish the mapping. 

In addition to the public key style mapping, unique certificate features or the windows active directory may be used to establish a mapping. 

Authenticate using UPN (if available in certificate) -  Allow mapping using UPN. This option uses the UPN in the SAN (Subject Alternative Name) field of the certificate to map the certificate to the user account. User will not be prompted for any additional information.

Authenticate against Active Directory Certificate Mappings - Allow mapping using the Active Directory mappings. These are listed under the Active Directory certificates. A direct user will be mapped, allowing only current user context. The mapping must be listed under the user's X.509 Certificates mappings.

Authenticate against Active Directory Kerberos Name Mappings - Allow mapping against the Active Directory Kerberos name mappings. This allows users to switch user context with the X.509 certificate. The mapping must be listed under the user's Kerberos Names mappings.

Revocation Checking - Set how certificate revocations are checked. A certificate can be part of a chain of certificates, any of which could be revoked.

Disabled - No revocation is checked.

Check entire certificate chain - The entire certificate chain, excluding the root certificate, is checked for any revocation.

Check only end certificate - The certificate passed for authentication is the only certificate checked.

Check entire chain excluding the root certificate - The entire certificate chain is checked for any revocation, except for the root certificate.

Certificate Storage

X.509 certificates for the server need to be stored in the Local Computer Personal Certificate Store.

1.Generate a computer certificate using your chosen certificate authority

2.Install the server certificate on the client computers under the Computer->Personal store

a.Launch the Microsoft Management Console (MMC),either from the command prompt or the Run option in the Start Menu.

b.From File menu, select Add/Remove Span-in

c.Click on the Add button and then select "Certificates" from the Add Standalone snap-ins dialog

d.Select "Computer account" for account option and click Next
.

e.Choose Local Computer and click Finish
.

f.Click OK to close the snap-in dialog.

Once the Certificates snap-in has been added, expand the tree and select the Personal folder. Expand the Personal folder and select Certificates.

The rootCA can be distributed to clients accessing the server. The rootCA should be stored on the client machines using the above steps, but storing the certificate under the Trusted Root Certification

Certificates can be obtained from a service, loaded from a certificate server on the domain, or self-signed.

Verisign, www.verisign.com, is one of many certificate services available to get a certificate.

Windows server installation disks contain the option to install a certificate server. The process is different for different versions of windows server. Please see the server installation documentation for specific instructions. If a domain certificate server is installed, machines will automatically be loaded with the appropriate CA and host certificates. Also, certificates can be requested by using the Certificates mmc snap-in context menus or via the certificate service's web interface.
For self signed certificates, you can use one of the Microsoft's tools to create a certificate. For SSL, the intended purpose needs to include "Server Authentication". Different tools will activate this property in different ways. For makecert, the parameter "-eku 1.3.6.1.5.5.7.3.1" needs to be included (the numbered string is the numerical representation for the "Server Authentication" purpose.

An example key generation is:

makecert -r -pe -n CN="machine_name" -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localmachine -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12

Here is a writeup from the web: http://tcle.wordpress.com/2008/05/20/creating-a-self-signed-ssl-certificate-without-a-mess-of-makecertexe-using-ssl-diagnostics-tool/