1

The windows iis6 resource kit won't install on Windows 7 (Home Premium) so I copied it from another machine and selfssl.exe is giving me:

Failed to generate the cryptographic key: 0x5

I tried the instructions here but am still getting the above error.

I'm trying to set the common name of the certificate to a name other than the machine name so I can avoid the certificate errors in the browser. This is a test web application. I know I can just test with the browser errors, but I'd like to mimic real world conditions as much as possible.

Is there any other way to generate your own ssl certificates for iis7.5 and set the common name yourself?

Improve this question

3 Answers 3

Reset to default
1

I'm trying to set the common name of the certificate to a name other than the machine name so I can avoid the certificate errors in the browser.

To my knowledge, unless you install the cert into the root store of each machine that visits, you'll continue to get those cert errors (at least initially) because they aren't from a trusted root source. There's really no way around that with self-signed certs.

As for creating the self-signed certs, you can do that right in IIS manager. Open IIS Manager, click on Server certificate, select the create self signed certification action link.

Improve this answer
1
  • Yeah, when I did the self signed certs via iis manager, I got the certificate warnings on the browser. I guess I can just live with them, or change the name of my site to the server name.
    – Steve
    Mar 26, 2010 at 15:59
1

You can get a free cert from http://www.startssl.com/ for your site. With self-signed certs, you will always get a warning unless it is in the trusted root certificate store as GregD pointed out. There is no other way to verify a self-signed cert.

In a sense, all CA roots are self-signed certificates your machine trusts, but they also have the ability to sign other certs, so that is how certificate chains work.

Improve this answer
3
  • So if I get a startssl free certificate for testing purposes and then later on, I want to use another certificate from another company when the site goes live, that would work? But then for the test certificate, the common name would be peanut.com rather than peanut, which is how I access the webapp in my test environment - peanut.
    – Steve
    Mar 26, 2010 at 15:50
  • Yes, getting another cert will work fine, as long as the Subject or Subject-Alternate-Names field contains the name you use to reach the webapp. You can change certificates at your convenience.
    – Nasko
    Mar 31, 2010 at 14:45
  • I forgot to add that you can get a certificate (probably not the free one) that has multiple names for the same site, which will allow you to access it over https using different names. You can add peanut and peanut.com to the SAN field (subject-alternate-names) and it will work just fine : ).
    – Nasko
    Mar 31, 2010 at 14:47
1

It is possible to create Self-Signed Certificate... directly from IIS 7.5 MMC. You will need to open IIS MMC -> click on the Machine Name (e.g. SERVER2) and in the Features View you will see Server Certificates -> double click and it will open Server Certificates -> on the right hand side under Actions click on Create Self-Signed Certificates. Check this out

alt text
(source: dotnetscraps.com)

alt text
(source: dotnetscraps.com)

Ignore the marking's as it was used for some other purpose ;-)

Improve this answer
1
  • The Self-Signed option is three rows lower.
    – skolima
    Feb 27, 2013 at 12:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .