Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to work with certificates and the third part authority send me values:

[...]Many letters and digits[...]

[...]Many letters and digits[...]

But I need a .cer file to put in my IIS. How can I create this .cer file?

Thanks in advance for any answers.

share|improve this question
up vote 14 down vote accepted

What you've been given is a Certificate (the public part, signed by a trusted party) and the associated key (the private part). In simple terms it's the private key that allows your app to sign stuff in a way that the remote party can then validate using the public part, the certificate. Your server needs to have both linked together so that protocols like SSL\TLS can work properly.

In your case you have been given a complete pair, not just the Cert. The format you have been given it is called PEM and unfortunately Windows Certificate Manager can't import that natively (to the best of my knowledge).

The quickest way I've found to convert it is to install OpenSSL somewhere and convert the file you have to PKCS#12 format using the following command. You will need to break the file you got from the CA into two parts, one containing the certificate block called "certificate.txt" and and one containing the private key block called "key.txt":

openssl pkcs12 -export -out mycertkey.p12 -in certificate.txt -inkey key.txt

Once you have the PKCS#12 format file you can import it into Windows:

  • Open the MMC ( Start -> Run -> MMC.exe ) and then select add\remove snap-in and add in the Certificates snap in.
  • Select "Computer Account" as the context.
  • Right click the "Personal" folder and select the "Tasks>Import"
  • Find the mycertkey.p12 file you created and import the certificate and private key into the Computer's Certificate store.

Once the cert is installed you can now assign it from within IIS (this may vary a bit depending on IIS version)

  • Open you IIS Management Console and right click the domain you want to assign the certificate to.
  • Select Properties
  • Select the "Directory Security" tab, and then "Server Certificates"
  • Follow the Certificates Wizard prompts, selecting Next, then select "Assign Certificate" and then Next again.
  • Find and select the certificate you have just imported and click OK.

That should do it.

share|improve this answer
thanks for your detailed answer, but openssl tells me : Loading 'screen' into random state - done unable to load private key – Tim Feb 9 '10 at 12:35
and now, I have a "no certificate matches private key" – Tim Feb 9 '10 at 13:22
Possibly something got corrupt while splitting the PEM format file. If you try the Openssl command using the original file from your CA as both the -in file and -inkey file it should work too. If it can match the pair it will prompt you for a password for the p12 output file. – Helvick Feb 9 '10 at 13:54
should be that, I've re-exported the file, and it's ok. Thanks a lot for your help – Tim Feb 9 '10 at 14:40
In your openssl command, changing the output filename from mycertkey.p12 to mycertkey.pfx will allow easier import. PFX is a registered file extension in Windows that you can just double click on to start the certificate import wizard. – Ryan Bolger Feb 9 '10 at 18:26

This article covers the process of creating a certificate request and installing the certificate once the signing authority (GoDaddy, Thawte, etc.) has issued your certificate.

share|improve this answer

The string you pasted is Base64 DER encoded X.509 certificate.

What certificate file format does IIS expect? The simplest try is to save this stuff in a .cer file and pass it to IIS.

See for details

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.