1

I know with Apache if you have an SSL certificate with an encrypted private key, you need to enter a passphrase whenever you restart the server in order to decrypt it and load the key/certificate. (Or you used to, at least.)

Does a similar thing happen on Windows with ISA/IIS and the built-in certificate store? Or, when you import a certificate does that obviate the need for entering the passphrase all the time? Does it ask when you reboot, restart IIS, etc.?

I'm trying to determine how impactful it will be and/or if I should decrypt the key...

Improve this question
1
  • as far as apache is concerned, if you strip the passphrase from the private key the server will start without prompt. – Olivier S Jun 11 '13 at 19:22
1

Importing the certificate to the Windows certificate store does not require you to reenter the passphase post-import, nor reboot, restart or otherwise affect IIS. You will never be asked again, post-import.

Follow the steps here to import a certificate (iis7).

Note that you need to combine your issued certificate and unencrypted private key into a .pfx file (PKCS#12 format) in order to import it into IIS. So another way to look at it is that you can't do that at all.

Improve this answer
1
  • Actually I found old instructions (that I wrote, ha!) on how to convert it to a PKCS#12 file using openssl (such a useful command). I even wrote batch files to do all this for me...ugh. – Josh Jun 12 '13 at 16:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.