Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The windows iis6 resource kit won't install on Windows 7 (Home Premium) so I copied it from another machine and selfssl.exe is giving me:

Failed to generate the cryptographic key: 0x5

I tried the instructions here but am still getting the above error.

I'm trying to set the common name of the certificate to a name other than the machine name so I can avoid the certificate errors in the browser. This is a test web application. I know I can just test with the browser errors, but I'd like to mimic real world conditions as much as possible.

Is there any other way to generate your own ssl certificates for iis7.5 and set the common name yourself?

share|improve this question

I'm trying to set the common name of the certificate to a name other than the machine name so I can avoid the certificate errors in the browser.

To my knowledge, unless you install the cert into the root store of each machine that visits, you'll continue to get those cert errors (at least initially) because they aren't from a trusted root source. There's really no way around that with self-signed certs.

As for creating the self-signed certs, you can do that right in IIS manager. Open IIS Manager, click on Server certificate, select the create self signed certification action link.

share|improve this answer
Yeah, when I did the self signed certs via iis manager, I got the certificate warnings on the browser. I guess I can just live with them, or change the name of my site to the server name. – Steve Mar 26 '10 at 15:59

You can get a free cert from for your site. With self-signed certs, you will always get a warning unless it is in the trusted root certificate store as GregD pointed out. There is no other way to verify a self-signed cert.

In a sense, all CA roots are self-signed certificates your machine trusts, but they also have the ability to sign other certs, so that is how certificate chains work.

share|improve this answer
So if I get a startssl free certificate for testing purposes and then later on, I want to use another certificate from another company when the site goes live, that would work? But then for the test certificate, the common name would be rather than peanut, which is how I access the webapp in my test environment - peanut. – Steve Mar 26 '10 at 15:50
Yes, getting another cert will work fine, as long as the Subject or Subject-Alternate-Names field contains the name you use to reach the webapp. You can change certificates at your convenience. – Nasko Mar 31 '10 at 14:45
I forgot to add that you can get a certificate (probably not the free one) that has multiple names for the same site, which will allow you to access it over https using different names. You can add peanut and to the SAN field (subject-alternate-names) and it will work just fine : ). – Nasko Mar 31 '10 at 14:47

It is possible to create Self-Signed Certificate... directly from IIS 7.5 MMC. You will need to open IIS MMC -> click on the Machine Name (e.g. SERVER2) and in the Features View you will see Server Certificates -> double click and it will open Server Certificates -> on the right hand side under Actions click on Create Self-Signed Certificates. Check this out

alt text

alt text

Ignore the marking's as it was used for some other purpose ;-)

share|improve this answer
The Self-Signed option is three rows lower. – skolima Feb 27 '13 at 12:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.