Creating a SSL Certificate with SelfSSL
This post will explain how to create a self signed SSL certificate using SelfSSL.exe and exporting the certificate as a .pfx file.
What is SelfSSL?
There are many ways to create self signed SSL certificates. One way is to create a Standalone Root CA.
http://mystyleit.com/blogs/mystyleit/archive/2007/08/23/how-to-configure-forms-based-authentication-in-exchange-server-2003-owa.aspx
Another, more less complex, way is to use SelfSSL.exe. SelfSLL.exe is part of the IIS 6.0 Resource Kit Tools. This pack is available for download directly from Microsoft.
http://support.microsoft.com/kb/840671
Installing SelfSSL
To install SelfSSL download the IIS 6.0 Resource Kit Tools using the above link and install it using the following options.
Creating the SSL Certificate
Start SelfSSL by navigating to
Start>Programs>IIS Resources>SelfSSL>SelfSSL
By default selfssl.exe will
- Create a SSL certificate using the hostname as the certificate Common Name
- Set the key length to 1024
- Set the validity length to 7 days
- Set the site ID to 1
- Set the site ID to 1
- Set the port to 443
SelfSSL tries to do more then just spit out self signed certificates, it will (if installed) configure IIS to host the certificate as well.
I personally don't want this and therefore never run SelfSSL.exe on a machine running IIS.
To create your own Self Signed SSL certificate simply call seflssl.exe with parameters you want.
Example:
selfssl.exe /N:CN=domainname /K:1024 /V:1825
You will get prompted to overwrite the settings for site 1, answer yes and then you'll be informed that there was an error opening the metabase (assuming you are not running IIS on the same machine). The errors occur because selfssl failed to configure IIS because it cannot find it.
Exporting the SSL Certificate As A PFX File
Now that you have created the self signed SSL certificate, you need to export it. To export the certificate first open the Microsoft Management Console by going
Start>Run>mmc
Next add the Certificates snap in by going
File>Add/Remove Snap-in...>Add>
and choose Certificates
Finally when prompted to choose between
- My user account
- Service account
- Computer account
choose Computer account.
Choose Local Computer and click Finish
Expand the following
Console Root>Certificates>Personally>Certificates
Right click on the certificate and choose
All Tasks>Export
Complete the following steps
- Click Next
- Choose Yes, Export the Private Key
- Click Next
- Choose Yes, Export the Private Key
- Click Next
- Enter a password for the key (don't forget it)
- Enter a location to export the certification along with a file name
- Click Finish
You pfx file has not been created. You can now have you ssl certificate!