Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to start making client certifications to secure some internal services. The ones are some web services and an internal Jabber server.

And if the process is easy enough maybe make certificates for the authorized clients.

update: I'm looking for a AIX or Windows Server 2008 solution.

share|improve this question
Is it safe to assume, as the first answer does, that you are asking about doing this on Windows? – David Z Jul 25 '09 at 5:44
Yeah what OS do you prefer to set this up on, that will definitely shape the answer given. – Tatas Jul 25 '09 at 5:50
up vote 9 down vote accepted

If you have OpenSSL, you can use my handy guide.

share|improve this answer
That's a really straightforward and helpful guide; thanks for writing that up. – Hans L Sep 6 '12 at 12:12
You should copy the relevant pieces of your guide to your answer instead of just linking your blog (which may or may not always be around). – kce Aug 7 '13 at 17:14

First thing you need to do is make sure Certificate Services component of windows server is installed. This allows creation of certificates for servers. I believe one server has to be the certificate authority.

Start->Add/Remove Programs->Add/Remove Windows Components->Check Certificate Services

First start with a root authority.

Then once this is installed, you can make certificates for individual servers.

Start->Administrative Tools->Internet Information Services (IIS) Manager Right click a website, and click properties. Directory Services Tab->Secure Communications

Once that is done, you need to use the Root CA to accept the certificate request.

Go to http://server/certsrv you can have the certificate accepted by the Root CA

share|improve this answer
I also think that all the clients need to be configured to accept the Root CA as valid, which in itself can be management problem. – pcapademic Jul 25 '09 at 6:45

If you really are a masochist and want to run your own CA, you can use:

  1. Open CA. This can be run inside JBoss/Tomcat/ you can get it from

  2. OpenSSL also comes with it's own CA capability. search for openssl + ca

  3. There is a python CA available at

Says on the bottom of the page that this is no longer actively maintained.

I gave up torturing myself and found that the best way of getting and more importantly managing free certs was to use

Sign up and you can create certificates for free, they are the CA and have a root cert you can import into your keystore so you don't get the annoying questions from the browser etc. Takes a lot of the pain out of managing your own CA like they send you an e-mail when certs are going to expire etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.