We have an internal test version of our website, which is available (via internal DNS zones) as www.mysite.com.test

I'd like to create an SSL certificate for www.mysite.com.test, so that our testers don't get an invalid certificate warning (the 'real' certificate is bound to www.mysite.com)

I know how to create self-signed certs using OpenSSL, but I'm wondering if there's some way of associating the certificate authority with our Active Directory domain, so that any user on a PC that's a member of the domain will accept the self-signed cert without having to explicitly install it (or explicitly install the self-signing certificate authority as a trusted authority)

Any ideas?

  • 1
    I would suggest changing the title as you are misusing terms. OpenSSL or MS Certificate services would be the CA, AD or group policy would merely be a method of rolling out the trusted root. – JamesRyan Jul 13 '12 at 11:24

You can add trusted roots through group policy. So make a self signed cert, roll this out as a trusted root, then any cert you sign with it will be trusted.

Policy Object Name/Computer Configuration/Windows Settings/Security Settings/Public Key Policies/Trusted Root Certification Authorities

Setting up the MS Certificate Authority is not required

| improve this answer | |
  • Fantastic. Exactly what I was looking for but didn't know how to ask for. :) – Dylan Beattie Jul 13 '12 at 12:15

If you have a server running the AD CS role issue a certificate, then it isn't self-signed anymore, it's issued by your internal CA. To answer the larger point, yes you can do this. You'll have to install the Active Directory Certificate Services role and create/distribute te certificates from there. No need to touch OpenSSL for this use case.

| improve this answer | |
  • 1
    You don't need the MS certificate authority to do this if you have already made the certificates using OpenSSL – JamesRyan Jul 13 '12 at 11:18
  • @JamesRyan Absolutely correct, I read the last paragraph of the question as him wanting a CA that integrates fully with AD. I didn't mean to imply that you can't distribute a cert made in OpenSSL - just that it would be unnecessary with an ADCS server. – MDMarra Jul 13 '12 at 13:27

To answer your question exactly: no, you can't create a self-signed cert using Active Directory. However, I think your question is mixing different things.

  • Self-signed certificates are NOT issued by an authority (that's why they are self signed)
  • You can integrate a certificate authority with Active Directory in order to automatize server and users certificates.

For creating self-signed certs, you have plenty of options. The simplest one, if you're a windows shop, is to do it through IIS (see this: http://technet.microsoft.com/library/cc753127%28WS.10%29). You can also do it with OpenSSL (quite messy but works), with the makecert.exe tool that comes with the .NET SDK or with a number of similar tools (I use my own tool for this but, that's just me).

For integrating a CA with AD, the simplest way is to install the certificate services role on a machine and configure it for AD integration (although in your case, it doesn't seem to be a necessity unless you want to use it for other things).

Finally, you might want to create your own root that isn't integrated with AD. Unless you have to work with client certificate authentication, have many different servers (with different names) that you want to use in testing (and perhaps with automated testing) or if you want to be able to test some aspect of your application that uses special certificate properties or chaining, it's probably not worth the trouble.

In your case, assuming I understood it correctly and all you want to do is test your web app with a certificate, all I would do is generated a self-signed cert (using whatever tool you like best) and then install that certificate in the correct store on your test machine (to avoid certificate warnings and errors)

| improve this answer | |
  • Thanks. The problem here is that it isn't a test machine, it's about two dozen people who are involved in testing various things across a number of different products, which means installing and authorising the certificate becomes a bit of a headache. Thanks for the advice, though - certificate services looks like a good idea... – Dylan Beattie Jul 13 '12 at 12:14
  • Test doesn't mean it's limited to a single system. It means it's limited to a specific security zone in which you accept additional risk as the price paid for the flexibility necessary for testing. It's pretty common to have two different CAs used for a single application: of is used for testing only (and is generally a private one since it'y way cheaper this way) the other being a public one that is used for general deployment. – Stephane Jul 16 '12 at 7:45

Can I create a self-signed IIS certificate using Active Directory as a CA?

No, you can not. SImple point - AD is NOT A CA. SImple like that.

WIndows has a CA component that you can install, bt it is not AD. It is a separate role. Once you do that, though - why use a self signed certificate at all?

| improve this answer | |
  • He isn't actually asking to use AD as a CA. He is asking how to roll out certificates to a domain. His title is wrong but you don't answer the actual problem. – JamesRyan Jul 13 '12 at 11:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.