Generate a Trusted Cert by OpenSSL?

Question

I using the following command to generate a *.pfx for IIS7.

C:\OpenSSL-Win32\bin\openssl.exe genrsa -out "C:\my_key.key" 2048

C:\OpenSSL-Win32\bin\openssl.exe req -new -key "C:\my_key.key" -out "C:\my_request.csr" -config "C:\OpenSSL-Win32\bin\openssl.cfg"

C:\OpenSSL-Win32\bin\openssl.exe x509 -req -days 3650 -in "C:\my_request.csr" -signkey "C:\my_key.key" -out "C:\my_cert.crt"

C:\OpenSSL-Win32\bin\openssl.exe pkcs12 -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -export -in "C:\my_cert.crt" -inkey "C:\my_key.key" -out "C:\my_pkcs12.pfx" -name "MyNameHere"

However,IIS said that , it is not trusted.

So, how can i generate a trusted cert ? Or i really need to buy one?

Answer 1

It is easy enough to get your server to trust it ... install it into the Trusted Root Cert store. Use mmc, open the certificates snap-in, and the rest you can figure out.

The problem is that doesn't get anyone else to trust it, which is kind of the point. The only way to eliminate the messages on the other end is to get the cert from a trusted source. Comodo sells them for $10/year.

Note: if you are securing an Exchange 2007 or 2010 installation, there is more to it. You need a different kind of cert (called a UCC cert) which includes all of the domains involved. GoDaddy is the cheapest place to get those that I know of.)

Answer 2

If you want other people to trust your site, yes you need to purchase a cert. If you just want to encrypt a site with SSL, and don't care about the warnings you can just use the one you generated.

Basically the third party that you purchase a cert from is part of a chain of trust, they vouch for you and do some basic checking to make sure you are who you say you are. When you just generate your own cert other clients aren't going to just take your word for it, but if they know who you are they might not care if the cert is valid or not as long as the communication is encrypted.