Due to the popularity of Windows 2008 Server Core I have seen frequently questions about how to configure SSL on IIS7 with only command-line. Since I wandered that path few months back I thought of putting this article/guide together. There are 3 simple steps involved 1. Importing the Certificate into relevant Certificate Store If you have a .CER file
certutil –addstore MY test-cert.cer
OR
If you have .PFX file
certutil -importpfx <filename.pfx>
OR
Create and Import test certificate using MakeCert.EXE (which comes with Visual Studio SDK Tools)
makecert -r -pe -n "CN=sukhyper-v" -b 01/01/2008 -e 01/01/2010 -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localMachine -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12
2. Configure SSL with HTTP.SYS (command below should be entered on a single line) netsh http add sslcert ipport=0.0.0.0:443 certstorename=MY certhash=b63293e9c24f7fda4c671beac4a0eff29e0d3b52
appid={5a599f4f-02dc-4120-8646-74fcbc5b4827}
appid can be any unique GUID but I used ‘Key Container’ value of the certificate for ease of use!
Output of certutil –store MY
================ Certificate 1 ================
Serial Number: ab171a1627a592964d358ec9736da78a
Issuer: CN=sukhyper-v
NotBefore: 1/1/2008 12:00 AM
NotAfter: 1/1/2010 12:00 AM
Subject: CN=sukhyper-v
Signature matches Public Key
Root Certificate: Subject matches Issuer
Cert Hash(sha1): b6 32 93 e9 c2 4f 7f da 4c 67 1b ea c4 a0 ef f2 9e 0d 3b 52
Key Container = 5a599f4f-02dc-4120-8646-74fcbc5b4827
Unique container name: ec4840c8098979e9cc0eb699ef979eaf_931d1088-a4b3-4332-b918-8d75ab3e674e
Provider = Microsoft RSA SChannel Cryptographic Provider
Encryption test passed |
3. Add HTTPS binding on the website using this certificate appcmd set site “Default Web Site” /+bindings.[protocol=’https’, bindingInformation=’*:443:’]
Other related commands
Enforce SSL for the site with 128bit
appcmd set config "Default Web Site" -section:access -sslFlags:Ssl,Ssl128 -commit:apphost Add SSL Binding in IIS
appcmd set site "Default Web Site" /+bindings.[protocol='https',bindingInformation='*:443:'] Remove SSL Binding in IIS
appcmd set site "Default Web Site" /-bindings.[protocol='https',bindingInformation='*:443:'] Show Certificate endpoint from HTTP.SYS
netsh http show sslcert Delete Certificate endpoint from HTTP.SYS
netsh http delete sslcert ipport=0.0.0.0:443 View Certificate Store
certutil -store MY View Certificate Store with UI
certutil -viewstore MY
Currently rated 5.0 by 2 people - Currently 5/5 Stars.
- 1
- 2
- 3
- 4
- 5
|