IIS6 - install SSL certificate - pem file

Question

Consider the need to secure a website under IIS 6 / Windows 2003. Here are the steps taken:

• Created a private key by OpenSSL:

  openssl genrsa -des3 -out filename.key 2048

• A CSR was created by OpenSSL with the .key file resulted from above.

  openssl req -new -key filename.key -out filename.csr

• The CSR was sent to a Certificate Authority. It returned a .pem file.

As I understand, the .pem is the certificate itself. It's unclear to me whether any further processing is needed to match the .key with the .pem. The CA is now in the list of Trusted Root Certificate Authorities in IE7.

Question

• What steps are needed to convert the .pem into a new file or usable format for use in IIS?

I suspect I'll need a .pfx

Answer 1

Yes you'd need to recombine the cert with the private key to form a pfx prior to importing with this tool. Currently the private key is in file format on your system and not in the systems local store.

This commmand is an example

C:\Tools\OpenSSL\bin>openssl pkcs12 -export -in cert.pem -inkey key.pem -certfile cacert.pem -out cert.pfx

where cert.pem is the returned cert, key.pem should be replaced with your filename.key and cacert.pem is the ca certificate. Output is the pfx file that you can use in your wizard, above.