IIS Server Security, SSL Certificate

by **Katerina** » Thu, 25 Sep 2003 22:05:49 GMT

Hi,
I make CSR for one domain and for it i take one test trial
certificate and post this CSR for buy certificate.
I install trail certificate and when i recieve the
purchased i try to replace the trial with this, but ...
certificate is installed succesiful, but say that havn't
Private Key.
Please tell me how i can export from trial and after
import Private Key to purchased certificate.
Thanks.

Regards: Katya

by **Bernard** » Wed, 01 Oct 2003 12:39:48 GMT

Proxy.. not sure.. but try these kb
PRB: Error "Page Cannot Be Displayed" When You Connect Through HTTPS
http://support.microsoft.com/?id=290391

HOW TO: Determine If SSL Connectivity Is Not Working on the Web Server or on
an Intermediate Device
http://support.microsoft.com/?id=290051

"Cannot find server" or "DNS" Errors When Using SSL (Q & A)
http://support.microsoft.com/?id=292296

at command prompt, enter
"netstat -an", see anything binding on port 443 ?

anything in event log ?

--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...

by **Mark** » Wed, 19 Nov 2003 22:34:07 GMT

How can I create my own SSL certificate? (without using any CA)

by **Keith W. McCammon** » Wed, 19 Nov 2003 23:37:52 GMT

You can't. If you have 2000/2003 Server, install the built-in CA and create
your certs there.

by **Aaron** » Wed, 19 Nov 2003 23:44:15 GMT

use OpenSSL.
http://www.dylanbeattie.net/docs/openssl_iis_ssl_howto.html

by **Karl** » Thu, 20 Nov 2003 02:56:24 GMT

Thank you for the quick reply. The process completed without any errors but
IIS will not accept the certificate.

by PL » Thu, 20 Nov 2003 04:37:03 GMT

Use this, works for me:
http://www.inventec.ch/chdh/notes/14.htm

Note that this is a .NET program and thus requires the .NEt runtime installed,
after that just follow the instructions.
The following command can be used to create and import a self-signed SSL test certificate:

makecert -r -pe -n "CN=www.yourserver.com" -b 01/01/2000 -e 01/01/2036 -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localMachine -sky
exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12To install this certificate in IIS 5.0, open the IIS "Web Site
Properties", "Directory Security", "Server Certificate...", "Assign an existing certificate" and select the new certificate from the
list.

Of course these are still for demo/test/intranets and not real certs you can use
on a public site because no one will be fooled by them even though they are
fully usable no one will trust them.

PL.

by **Aaron** » Thu, 20 Nov 2003 04:46:30 GMT

Since the cert was written in Unix format (there are little boxes for
line breaks in notepad) you have to open it in WordPad to view it, then
copy it to notepad, then save it ... then install it and IIS will accept
it ... the author left that out of their doc :) I have used the method
below without trouble ...

by **Aaron** » Thu, 20 Nov 2003 04:46:57 GMT

I guess you could also just do a search / replace for the little boxes
and replace them with a line break

by **Karl** » Thu, 20 Nov 2003 05:08:37 GMT

Thank you for your reply. The process is failing again with the message
"Keyset not found". Any Ideas what the problem could be? thank you

installed,
test certificate:
01/01/2036 -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localMachine -sky
install this certificate in IIS 5.0, open the IIS "Web Site
existing certificate" and select the new certificate from the
can use
are

but

by **Karl** » Thu, 20 Nov 2003 06:01:27 GMT

Sorry for posting to the wrong thread. Your method succeeded in generating
the certificate and I was able to use assign the certificate without any
error. At this point I cannot access my test website whether I use http://
or https://

Is there something else I need to do besides configuring my website to use
SSL which I configured like Microsoft recommends?

installed,
test certificate:
01/01/2036 -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localMachine -sky
install this certificate in IIS 5.0, open the IIS "Web Site
existing certificate" and select the new certificate from the
can use
are

but

by PL » Thu, 20 Nov 2003 06:24:51 GMT

Not to my knowledge, you need to have port 443 open in the firewall
if you use one.

Check your settings, verify that the server is running, check firewall settings,
other than that I have no suggestions, sorry.

PL.

by **Paul Lynch** » Thu, 20 Nov 2003 07:52:18 GMT

Mark,

If you are using W2K3 you can use SelfSSL from the IIS6 Resource Kit :

http://www.microsoft.com/downloads/details.aspx?FamilyID=56fc92ee-a71a-4c73-b628-ade629c89499&DisplayLang=en

Regards,

Paul Lynch
MCSE

by MS » Wed, 26 Nov 2003 02:17:17 GMT

Hello,

I've installed an SSL certificate I created on an IIS 5.0 server. Whenever
our client use the website, they are asked to accept our SSL certificate
even after they install it. Is there a way to prevent the users from getting
prompted to install our certificate over and over again? Thank you in
advance.

by **adavis** » Thu, 27 Nov 2003 02:43:08 GMT

This posting is provided "AS IS" with no warranties, and confers no rights.

MS,

Are the users prompted because the certificate has been issued by a CA they
don't trust?

When using the "install certificate" button the Root CA certificate is
placed in the intermediate store, not the Trusted Root Store. When the
browser is closed the Root CA is removed from the Intermediate store.
Clients getting this prompt should install the Root CA certificate to the
Trusted Root Store.

There is a KB with ASP code included that will users can browse to and it
will prompt them if they want to install the Root CA in the Trusted Store,
and it works great!

297681 Error Message: This Security Certificate Was Issued by a Company that
http://support.microsoft.com/?id=297681

Thanks!
~Andrew Davis
Microsoft PSS Security

IIS Server Security, SSL Certificate

IIS Server Security >> SSL certificate

IIS Server Security >> SSL Certificate

IIS Server Security >> SSL Certificate

SSL Certificate

SSL Certificate

SSL Certificate

SSL Certificate

SSL Certificate

SSL Certificate

SSL Certificate

SSL Certificate

SSL Certificate

SSL Certificate

SSL Certificate

RE: SSL Certificate