Using a Self-Signed Certificate

If you don't have a web server certificate which has been issued by an internal or public Certificate Authority, but you'd like to test with SSL operations, you can create a self-signed certificate. This can be done within the Internet Information Services (IIS) Manager.

Once the self-signed certificate is created and clients are configured to trust it, you can follow the steps to Configure StifleR to use SSL.

Creating the Self-Signed Certificate

1. Open IIS Manager (InetMgr).

2. Select the Computer Name or root.

3. Open the Server Certificates link.

4. In the Actions pane, select Create Self-Signed Certificate.

5. At the "Specify Friendly Name" dialog box, enter a friendly name and select the Personal store. Click OK to create the certificate.

Copy the self-signed Certificate to the Trusted Root Certification Store

Once you have a self-signed certificate, you need one more step to make the certificate trusted so that HTTP clients will accept it on your machine without error. The process involves copying the certificate from the personal store to the trusted machine store:

1. From the Run command execute: certlm.msc.

2. Go into Personal | Certificates folder and find your certificate.

3. Right-click and copy the certificate, and paste it into the to Trusted Root Certification Authorities | Certificates folder.

Now that you have a self-signed server certificate, you must now install the certificate on your clients so they will trust the server certificate. To do this, you will have to export the self-signed certificate to a file.

Exporting a Self-Signed Certificate

Once you have a self-signed certificate, you can export it so it can be installed on clients:

1. From the Run command execute: certlm.msc.

2. Go into Personal | Certificates folder and find your certificate.

3. Right-click the certificate, and in the context menu, select All Tasks | Export.

4. At the "Certificate Export Wizard" click Next.

5. At the "Export Private Key" screen, select Yes, export the private key, and click Next.

6. Proceed through the rest of the wizard and the end result should be a .PFX file which can be imported on clients.

Note: In the Certificate Export Wizard, you will be asked to secure the certificate with a group or username or password. If automating the deployment of the certificate, using a group may be easier than a password, so the password is not exposed in whatever command you use to import the certificate on a client. If importing the certificate manually, a password is acceptable.

Importing the Self-Signed Certificate on Clients

For clients to trust the self-signed certificate on the StifleR Server, the exported certificate (.pfx) file will need to be imported into the following client LocalMachine certificate stores:

• Personal\Certificates (My)

• Trusted Root Certificate Authorities\Certificates

This can be done by using the certutil.exe -importpfx command or this can also be done via PowerShell using the following command:

#imports the certificate to the Personal Certificates (My) store
Import-PfxCertificate -FilePath <Path to .PFX file> -CertStoreLocation Cert:\LocalMachine\My
#imports the certificate to the Trusted Root Certificate Authorities store
Import-PfxCertificate -FilePath <Path to .PFX file> -CertStoreLocation Cert:\LocalMachine\Root