Was hoping someone could help me out with this one as there seems to be conflicting articles on the subject.

I've got a legacy server running Windows Server 2003 R2 with IIS6 and need to generate an SSL Certificate Request in SHA-256.

I've installed this Hotfix from MS (http://support.microsoft.com/kb/948963) which is supposed to add SHA-256 support.

Now that its been installed, how exactly do I get IIS to generate the CSR in SHA-256?

Thanks in advance



There are a few updates that add SHA-256 support in Windows Server 2003. The one you need is KB2868626; when installed this update will enable you to install SHA-256 SSL certificates on Server 2003 SP2. You may want to install the ones below as well so you can connect to your own site.

KB938397 adds SHA-256 support to Server 2003 (SP1 or SP2). This update only enables Server 2003 to connect to sites that are using SHA-256 certs, but cannot serve them up itself (for that you need the above KB2868626). There is an additional SHA-2 update where XP & Server 2003 clients cannot get SHA-256 certificates from Windows Server 2008, that is KB968730.

Regarding the CSR generation, if you are purchasing a certificate from a public CA you shouldn't need to specify the signature algorithm in the CSR. The CA will issue your cert signed with SHA1 or SHA2 depending on your selection and/or the CA's issuance policy.

I did look into it and I don't see a way in Server 2003 to create a SHA-256 CSR. There is a utility called "Certreq" built in to Windows. I don't see HashAlgorithm in the Server 2003 version of certreq, but it is present in later versions.

One other reference I found was creating a custom request through the MMC. In the tutorial it references selecting a hash algorithm, but the screenshot doesn't match. May be worth investigating.

Some additional Resources:

  1. SHA-2 and Windows
  2. Common Questions about SHA-2 and Windows
  3. Detailed SHA-2 Compatibility article.

There is no such thing as a SSL Certificate Request in SHA-256.

When creating a CSR you can only choose the size (1024 bit-4096 bit).
You need to send that CSR to a certificate authority that will sign it for you. Very likely they will sign it by default with a SHA-256 signature or will provide a listbox to choose between SHA1 and SHA-256.

Update: it seems that a CSR is indeed signed as well. Windows does that by default with SHA-1 but searching Google for 'iis csr sha256' finds a lot of pointers.

  • Hi Jeff,Thanks for the update... i've already tried the search you suggested but got lots of conflicting answers so was hoping someone might have managed to do this and have a definitive guide?
    – Chris
    Feb 25 '15 at 23:26

I think instead of generating the CSR in IIS6, it's better to go to other server running newer version like Windows 2008R2 or 2012R2 to generate the CSR, then send it to your CA. After you got the certificate, export it to the .pfx file and then go back to 2003R2 server, copy, and import it. I already successfully get it done on one of my 2003R2 boxes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.