I am creating self-signed SSL certificates in IIS 7.5 for internal use. The problem I have is that I want to create them so that they last for 10 years as it is only a dev environment.

I can't see an option in IIS 7.5 where you can specify a the time the certificate is valid for. By default it creates certificates that expire in 1 year.

Is there a way I can change this so it creates them so they are valid for 10 years ?

3 Answers 3


You can do this using the SelfSSL.exe tool that comes with the IIS6 Resource Kit. You can get the resource kit from here:


The installer just unzips the tools into a folder and doesn't interfere with any of your machine settings. The custom install option also allows you to pick which tools you want to install and into a folder of your own choice.

Open an Administrator command line and change directory to where you the SelfSSL command line tool was installed.

To generate a new self-signed SSL certificate that expires in 10 years execute the following:

selfssl /n:cn=www.mydomain.com /v:3650 /s:8 /k:2048

This will generate an ssl where:

  • /n:cn=www.mydomain.com - the SSL is for www.mydomain.com. The cn= (common name) is important so don't miss it out.

  • /v:3650 - number of days the certificate is valid for, in this case ten years

  • /s:8 - install the certificate in site id 8

  • /k:2048 - use a keylength of 2048 bits.

Unfortunately there is no way to output the SSL directly to a file, you have to install it into a site. The good news however is that the certificate is exportable.

If you want the warning about the SSL not being trusted when browsing to sites using your self-signed SSL to go away then you can fix that as well:

  1. Export the self-signed SSL to a .pfx file (you need to set a password, make sure you remember it)
  2. Launch (from the command line or Start -> Run) mmc certmgr.msc
  3. Browse to Trusted Root Certificate Authorities -> Certificates and right click to get to the Import... option:

    enter image description here

  4. Follow the wizard and specify the .pfx to import then click next (you'll need the password you set in step 1):

    enter image description here

  5. On the next wizard step we need to choose which store to use. Click the Browse... button which will open the Select Certificate Store window. We need to see the physical stores so make sure there's a tick in Show physical stores:

    enter image description here

    Expand Trusted Root Certificate Authorities and choose Local Computer as per the screen capture above then click OK and then Next >

  6. Click the Finish button on the final wizard step and if all is good you should see:

    enter image description here

Caveats and Gotchas:

  • SelfSSL may need the IIS6 Management Compatibility components installed. I can't tell because my own machines already have this installed and haven't got a VM handy to test this theory by removing them.

  • Issue the SSL to cn=www.mydomain.com and not cn=mydomain.com if you want to be able to add the SSL to the Trusted Root Certificate Authorities store.

  • Hi, THanks very much for your help. Definitely has assisted what I need to do. Cheers Jeff
    – user1153199
    Feb 19, 2012 at 0:55
  • I can't find a working download link for the IIS6 Resource Kit. Anyone know where it can be found?
    – John B
    Aug 15, 2012 at 13:40
  • @JohnBubriski - grr, MS are truly annoying. If you can wait until Friday I can stick a copy somewhere.
    – Kev
    Aug 15, 2012 at 16:14
  • Actually, I'm good now, I figured out a way. I'll post an answer...
    – John B
    Aug 15, 2012 at 16:35

As far as I understand, the problem with IIS 7.x is that you can't set the host header for the SSL binding.

Using the appcmd command line utility you should be able to do this. The sites can use the same certificate but will have different host headers.

If you run the following 2 commands with your data, it should configure the host headers.

c:\Windows\System32\inetsrv>appcmd set site /site.name:"local.yourdomain.com" /+bindings.[protocol='https',bindingInformation='*:443:local.yourdomain.com']

c:\Windows\System32\inetsrv>appcmd set site /site.name:"local.dev.yourdomain.com" /+bindings.[protocol='https',bindingInformation='*:443:local.dev.yourdomain.com']

Unfortunately, there is something else you need to do to get this to work, but I'm not sure exactly what. I know I did some IIS resets, and I re-selected the SSL certs, but I'm not sure of the order in which to do that. But I know that I didn't do anything 'fancy' like use another tool.

  • John, that should be it as long as the certificate is loaded on the server. You may have to select the SSL cert to use as well for each site. Aug 15, 2012 at 17:51
  • Yeah, I believe I had a self-signed cert already configured for the 2 sites.
    – John B
    Aug 15, 2012 at 18:01

OpenSSL can also be used to create self signed certificate as described in this Stack Overflow answer:


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .