I have decided to generate SSL for IIS. I have own CSR and private key. The SSL generated by CloudFlare is in pcks7 format. I would like to to combine it into one pfx formate in order to import it in iis.

I used to work with Start SSL certificate - I always worked with 3 - files - my ssl crt, private key and intermediate crt.

With cloudflare, there is intermediate missing. I have tried to skip it while generating pfx with OpenSSL, but when I use it with IIS server, I get a warning:

One or more certificates in the intermediate chain are missing...

There was no such a message with Start SSL pfx. Can I ignore it? What intermediate should I use? Or how can make sure that connection is properly encrypted?


Obtained PCKS7 details

Issuer: California, San Francisco, CloudFlare Origin SSL Certificate Authority, CloudFlare, Inc., US

Subject: CloudFlare Origin Certificate, CloudFlare Origin CA, CloudFlare, Inc.

Certificate status: The issuer of this certificate could not be found.

  • Can you show the issuer and subject of the certificates that you obtained from CloudFlare? From that information, we might be able to help find the "missing" certificates. – Castaglia May 10 '16 at 19:59
  • See my edit, please – pwas May 10 '16 at 20:15
  • Great, thanks! For the certificate for that "CloudFlare Origin SSL" cert, see this CloudFlare FAQ. – Castaglia May 10 '16 at 20:19
  • Thanks for the link ! I have tried to embed it into pfx file, but the same error occured. When imported CloudFlare Origin into system separately - yes, that was the point. Unfortunately, origin ssl is not trusted :( – pwas May 10 '16 at 20:27
  • The "CloudFlare Origin SSL CA" cert, from the above link, is self-signed; i.e. it is the root CA. I'm not sure how you tell IIS to trust such root certs, though. – Castaglia May 10 '16 at 20:34

To solve problem I needed import "CloudFlare Origin SSL" certificate as Trusted in "Ceritificates" snap-in in MMC (Microsoft Management Console).

Do not know why embbeding it in PFX files do not work - maybe due to untrusted ca certificate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.