How does one generate a self-signed (later a CSR for a real cert) SSL certificate for three domain controllers (dc1.example.com dc2.example.com dc3.example.com) for the Windows domain EXAMPLE.COM for use with LDAP

The subject, I believe, should be EXAMPLE.COM with three Subject Alternative Names being the dns names for each DC.

How do I generate this certificate preferably with openssl, and definitely without installing certificate services?


An additional requirement is accomplishing this using only existing tools built in to RHEL 6, Windows 2008 R2, or software which can be acquired from Microsoft directly.

  • 1
    What do you need the cert for? selfssl (iis resource kit) can create a self-signed cert. – TheCleaner Feb 28 '13 at 14:19
  • 1
    "for use with LDAP" – colechristensen Feb 28 '13 at 17:14
  • 1
    what's wrong with certificate services? – longneck Feb 28 '13 at 22:51
  • 3
    it is simply a requirement that certificate services not be used. it should not be necessary to install such a framework to generate a single certificate. in the end I want a CSR and a certificate to be signed by a 3rd party. – colechristensen Feb 28 '13 at 23:05
  • Whoever specified that requirement really needs to drop it. Or get moved off the project, fired, etc. – Michael Hampton Mar 7 '13 at 11:08

No need to use any GUI wrappers to the OpenSSL really, they never include all the options and add no value to the library. Nothing wrong with firing up the OpenSSL console, hitting ? to list all the commands and finding clarification on-line for those that you might need, IMHO. ;)

First thing to do is to make sure you have a valid openssl.cnf file in your openssl installation folder. If you're missing this file, then you can download it from here. Place this file in your openssl path and set the required environment variable to point to it:

set OPENSSL_CONF=[path & file name of your openssl.cnf file]

You will also need an additional config file with your domain controllers listed. Simplest is to just echo your list in a new file:

echo subjectAltName=DNS:dc1.example.com,DNS:dc2.example.com,DNS:dc3.example.com > example.com.cnf

Or you could create a new config file with a notepad, whatever. It will only require this single line in it:


Then start the openssl console (openssl.exe) and create your self-signed certificate using these two configuration files (the openssl.cnf will load with the req command automatically from the environment variable OPENSSL_CONF we set previously):

genrsa -out example.com.key 1024
req -new -key example.com.key -out example.com.csr

Enter all the required data as it asks you to. You might want to skip entering the password phrase (A challenge password []) if this certificate will be used on a web server, not to require entering it each time you restart it. In which case just leave that field blank.

We're nearly done. Now we only need to generate our certificate and pass it the other configuration file to include our DNS aliases (or in your case all three domain controllers):

x509 -req -days 365 -in example.com.csr -signkey example.com.key -text -extfile example.com.cnf -out example.com.crt

That's it. You should have your new example.com.crt, example.com.key and example.com.csr files ready to go in your openssl folder, and updated with the additional configuration that we set. You can check your certificate that it includes our DNS names (notepad will do, these values are in clear text).

Obviously, you could change these values to reflect your needs and this is only an example, using your own example values. If you don't want to fire up the OpenSSL console, then you can run all these commands from the system console just as well, preceding any command with a call to OpenSSL.exe with openssl. That's exactly equal to having OpenSSL console open.

Hope that's what you wanted to do, don't hesitate to ask for clarification in the comments,



Assuming a single DC can't handle the LDAP over SSL needs and that SASL isn't an option.

If you want a self-signed SSL cert like that you will probably need Selfssl7 found here: http://blogs.iis.net/thomad/archive/2010/04/16/setting-up-ssl-made-easy.aspx

It should be able to create what you are looking for.

  • It's great that somebody came up with a tool to make SSL things easy, but I'm in an environment where some tool found on a blog won't be adequate. I have a strong suspicion the tool is just a friendly wrapper around the actual process; the actual process being the object of interest. – colechristensen Feb 28 '13 at 20:16
  • 5
    That blog is from iis.net, one of the lead programmers on the IIS team at MS. If that won't suffice, you'll need to go digging at this point, there's a reason the guy wrote it. – TheCleaner Mar 1 '13 at 14:26

Without the framework you would be missing Certificate Revocation List (CRLs) and you'd still need a way to install a trusted root CA. So without the framework, you are probably going to have a tough time of it.

And the certificate services are built into Windows 2008, so other than enabling the features/roles, you shouldn't need anything other than what you already have.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.