Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking at generating a self-signed certificate, and only allow users who has client certificate installed on my web server. I am using IIS 6.0 with selfSSL to generate my .pfx web server certificate. i was looking at this atricle http://www.iisadmin.co.uk/?p=11&page=3 and it mentions about installing Client Certificate on Client Machine. How do i generate a Client certificate? do i use SelfSSL as well? if i use SelfSSL do i Use

selfssl.exe /N:CN=ClientName /K:1024 /V:7 /S:1 /P:443

OR DO i install the same certificate installed on web server?

share|improve this question
    
Cross posted superuser.com/questions/308204/… –  squillman Jul 8 '11 at 17:35
add comment

1 Answer

up vote 1 down vote accepted

You can generate client certificates using the Microsoft makecert utility (this utility is available in the Windows SDK):

http://msdn.microsoft.com/en-us/library/bfsktky3(v=vs.80).aspx

For example, the following command line will create a self-signed certificate, with an exportable private exchange key, and place it in the client's personal certificate store.

makecert -r -pe -n "CN=Recipient1" -sky exchange -ss my

In the event that the server does not trust this certificate, you will also have to add it to the server's Root Certificate Store, since it is self signed.

share|improve this answer
    
can i use makecert also from createing certificate for web server? –  Natasha Thapa Jul 8 '11 at 17:59
    
AFAIK, you could use makecert to create the web server certificate but I recommend selfssl because it does all the work for you -- it generates an SSL certificate and adds it to your website. Using makecert requires more steps. –  snowkoan Jul 8 '11 at 20:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.