Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm not an expert on IIS but every year I really struggle getting a certificate onto an IIS7 server that hosts our ecommerce website.

I buy my certificates via 123-reg and I get a GlobalSign private key and a public key sent to me for the certificate.

The 123-reg help pages are useless and it never works following their instructions, because the instructions dont explain how to use the private key during installation.

There must be an easier way to get this stuff installed as it seems such an ordinary thing to do, and I cannot work out what I'm missing. I dread this coming around every year, and I usually end up installing a load of freebie apps until one generates a file that IIS understands.

Can anyone tell me if there is a simple way to take a private and a public key text file and end up with a certificate ready to be used on my IIS7 website.

Many thanks in anticipation.

share|improve this question
    
What format are the files that you are holding? –  Chris Thorpe May 8 '11 at 9:04
    
just 2 ascii text files. One has the private key characters (starting -----BEGIN RSA PRIVATE KEY-----), and the other has the certificate characters (starting -----BEGIN CERTIFICATE-----) –  Dean Chalk May 8 '11 at 9:08
    
I think you'll have to clarify because it does not make sense that you would get a private key sent to you. The normal procedure is to generate a CSR (which implies generating a private key that you keep to yourself and a CSR containing the public key + some certificate metadata), then you'd send only the CSR (pubkey + metadata) to the CA and get a signed certificate (pubkey + metadata + signature) back. When renewing you may just get a new certificate with the same pubkey but updated metadata + signature, in this case your old private key is still what you need. –  Håkan Lindqvist Apr 6 at 13:03

2 Answers 2

Personally, I tend to use OpenSSL for this type of work: http://www.openssl.org/

If you're not dealing with certificates everyday, however, try something along the lines of: http://www.edwinbush.com/my-tools-page/pfx-generator which will combine your Private Key and the Certificate hashes into a PFX file that you can import to your certificate keystore as follows:

  1. Click Start
  2. Click Run...
  3. Type "mmc" and hit Enter
  4. File => Add/Remove Snap-in...
  5. Add Certificates 5a. Select "Computer Account" and hit Next 5b. Select "Local Computer" and hit Finish 5c. Hit OK
  6. Expand the Certificates node in the tree and select Personal
  7. Right click in the central pane
  8. All tasks => Import => Next 8a. Browse to where you saved the PFX file and hit Next --You may need to change the 'Filetype' field to 'All Files' 8b. Check the 'Mark as Exportable' box 8c. Keep all extended properties 8d. Place this certificate into the right store automatically 8e. Hit Finish

This certificate should be available for selection within IIS now when you go to set an HTTPS binding.

Oh, and one more thing - your CA may have provided you with intermediary/root chaining certificates when the certificate was issued. Ensure you install these into the relevant stores too, otherwise you'll have issues with IE. Firefox tends to be alright.

~MBT

share|improve this answer
    
The note about intermediate certificates is good but it's equally valid regardless the client. IE and Firefox sometimes behaving different in this regard is not a sign of different requirements but that Firefox uses its own list of trusted certificates while IE uses the Windows list of trusted certificates and that these are not identical. As for the intermediate certificates these should be presented by your own server as it should be enough for the client to trust the root in the certificate chain, it shouldn't have to know of all the potential intermediate steps. –  Håkan Lindqvist Apr 6 at 13:16

Did you already import the cert into IIS?

-- open IIS -- Click on the computer name --- Click on server certificate.

Do you see the cert listed here? You should since it is a renewal. On the right hand side click on complete cert request.

Hope this helps.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.