Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I using the following command to generate a *.pfx for IIS7.

C:\OpenSSL-Win32\bin\openssl.exe genrsa -out "C:\my_key.key" 2048

C:\OpenSSL-Win32\bin\openssl.exe req -new -key "C:\my_key.key" -out "C:\my_request.csr" -config "C:\OpenSSL-Win32\bin\openssl.cfg"

C:\OpenSSL-Win32\bin\openssl.exe x509 -req -days 3650 -in "C:\my_request.csr" -signkey "C:\my_key.key" -out "C:\my_cert.crt"

C:\OpenSSL-Win32\bin\openssl.exe pkcs12 -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -export -in "C:\my_cert.crt" -inkey "C:\my_key.key" -out "C:\my_pkcs12.pfx" -name "MyNameHere"

However,IIS said that , it is not trusted.

So, how can i generate a trusted cert ? Or i really need to buy one? enter image description here

share|improve this question
up vote 4 down vote accepted

It is easy enough to get your server to trust it ... install it into the Trusted Root Cert store. Use mmc, open the certificates snap-in, and the rest you can figure out.

The problem is that doesn't get anyone else to trust it, which is kind of the point. The only way to eliminate the messages on the other end is to get the cert from a trusted source. Comodo sells them for $10/year.

Note: if you are securing an Exchange 2007 or 2010 installation, there is more to it. You need a different kind of cert (called a UCC cert) which includes all of the domains involved. GoDaddy is the cheapest place to get those that I know of.)

share|improve this answer

If you want other people to trust your site, yes you need to purchase a cert. If you just want to encrypt a site with SSL, and don't care about the warnings you can just use the one you generated.

Basically the third party that you purchase a cert from is part of a chain of trust, they vouch for you and do some basic checking to make sure you are who you say you are. When you just generate your own cert other clients aren't going to just take your word for it, but if they know who you are they might not care if the cert is valid or not as long as the communication is encrypted.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.