Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking at generating a self-signed certificate, and only allow users who has client certificate installed on my web server. I am using IIS 6.0 with selfSSL to generate my .pfx web server certificate. i was looking at this atricle and it mentions about installing Client Certificate on Client Machine. How do i generate a Client certificate? do i use SelfSSL as well? if i use SelfSSL do i Use

selfssl.exe /N:CN=ClientName /K:1024 /V:7 /S:1 /P:443

OR DO i install the same certificate installed on web server?

share|improve this question
Cross posted… – squillman Jul 8 '11 at 17:35
up vote 1 down vote accepted

You can generate client certificates using the Microsoft makecert utility (this utility is available in the Windows SDK):

For example, the following command line will create a self-signed certificate, with an exportable private exchange key, and place it in the client's personal certificate store.

makecert -r -pe -n "CN=Recipient1" -sky exchange -ss my

In the event that the server does not trust this certificate, you will also have to add it to the server's Root Certificate Store, since it is self signed.

share|improve this answer
can i use makecert also from createing certificate for web server? – Natasha Thapa Jul 8 '11 at 17:59
AFAIK, you could use makecert to create the web server certificate but I recommend selfssl because it does all the work for you -- it generates an SSL certificate and adds it to your website. Using makecert requires more steps. – snowkoan Jul 8 '11 at 20:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.