Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My client sent me a CER file so I installed on my IIS. How do I verify that it has been installed correctly? The purpose of CER file is to access their SSL protocol.

Is there a sample aspx file that I can use to test ? or is there a tool that IIS provides ?

share|improve this question
installing the certificate is only half the way, you need to configure cryptography too, use openssl or to check if you don't have (among other things) 56bit DES or SSLv2 enabled – Hubert Kario Jan 4 '12 at 0:38

The easiest way is browsing to the website. I'd test both https://www and https:// to make sure you did the CSR correctly. Also, if you are using IIS you may have installed the cer file, but you made no mention of binding it. You'll have to bind https:// to the new certificate.

share|improve this answer

Browse to the website that you installed the certificate for using https. If it loads without any errors, then the certificate is installed correctly.

share|improve this answer

If the certificate is for a publicly-accessible site you can use a number of online certificate checkers such as Qualys, DigiCert, and SSL Shopper. Since this is for a client you should probably add a certificate expiration check to your NMS (you do monitor your network, right?) For example, Nagios has several plugins that can check SSL certificates for validity and impending expiration.

share|improve this answer

If you've been sent a CER file to enable SSL on your website, and you didn't start a certificate request for that website, forget it, you've been sent the wrong thing.

On Windows, a PFX file can contain a private key, and that's the part that enables you to encrypt stuff which can be verified with the public key (certificate) associated with it. When you have a working TLS/SSL capable certificate, you'll see a "You have a private key associated with this certificate" message at the bottom of the General page for that certificate. No key = no signing/encryption.

If you've been sent a CA certificate, or a self-signed certificate for a target website to enable you to do SSL to it without errors, then fair enough; you can jam it into the Trusted Root Certificate Authorities store, and then hope the target organization is trustworthy and isn't about to start impersonating other websites on you.

Alternatively, they can buy a certificate from a reputable public CA.

share|improve this answer

Microsoft also provide a tool for SSL diagnostics I havnt got the link at hand, but a quick Google search should get you it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.