Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to use TLS encryption with Virtual Machine Remote Control (VMRC) for Microsoft Virtual Server 2005 SP1.

Virtual Server doesn't allow you to upload an arbitrary self-signed certificate; it generates a certificate signing request (CSR) that then needs to be signed by a Certificate Authority (CA).

I don't have a Windows Certificate Authority, and can't install it because I don't have access to Windows Server.

Can I use a self-signed CA certificate (generated with either MakeCert or OpenSSL) to sign the certificate signing request (CSR) that Virtual Server generates?

If so, how do I do this (using either MakeCert or OpenSSL)? I've only ever used MakeCert and OpenSSL to create signed certificates from scratch, not to sign CSRs.

share|improve this question
up vote 1 down vote accepted

I've always used SelfSSL from the IIS 6 resource kit to generate SSL certs. It's pretty easy to use.

share|improve this answer
Doesn't appear to be able to sign CSRs, unless I'm missing something. – Roger Lipscombe Jul 1 '09 at 9:35
You don't need the CSR. SelfSSL will take care of everything. See:… – Ausmith1 Jul 1 '09 at 19:59

Are you using R2 ? I have an option in Virtual Server 2005 R2 (Enterprise Edition) to upload a certificate...

Haven't tried it, but I'm guessing using SelfSLL from the IIS Resouce Kit to generate a cert and then uploading it would work.

See screenshot of the R2 config page here

.. Ken

share|improve this answer
Doh! Yes I am, and yes, that option's there. I'll try it later; if SelfSSL or MakeCert work, then I'll accept your answer. – Roger Lipscombe Jul 2 '09 at 11:37

I'm not familiar with MakeCert or OpenSSL, but it's pretty trivial to install the certification authority and generate your own certificates. Well, I'm assuming you're running a server version of Windows ...


share|improve this answer
Can't use Certificate Authority; updated question – Roger Lipscombe Jun 30 '09 at 15:26

OpenSSL is pretty comprehensive I'd be surprised if it can't do what you need. Provided you're comfortable poking about in it's config files you will certainly have no problem issuing x.509 certs that are fully RFC compliant for any standard use but if Virtual Server makes uses of custom OID's you may run into issues. I wouldn't expect that though, to be honest, and I have successfully used OpenSSL issued certs to set up TLS links with MS infrastructure in the past. This appears to be a basic explanation of the process used to get an ancient version of IIS to use a cert issued safely by an OpenSSL CA. Fair warning, I haven't done this recently and things may be different now but that should be enough to get you started.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.