makecert and creating ssl or signing certificates
I’ve been asked to post my makecert scripts for creating self-signed certificates (one for SSL and the other for signing). I use both of these scripts as .bat files. These scripts accept one parameter — the CN (common name) you want the certificate to match. For the SSL cert this must match the host name. For signing it’s just a unique name. Both of these need to be run from an administrative command prompt because the scripts install the certificate into the local machine’s personal certificate store. If you need the public key portion (.cer) then you’d have to open mmc and export it. Also, notice the expiration in the scripts — this is something you might want to change based upon your situation.
The first script is for creating SSL certificates. This is good for setting up SSL on your local IIS for a new web site (you’d need to ensure the host is indicated and SNI is configured). Although the SSL certificate won’t be trusted until you configure the cert as trusted on the client machine. Here are the .bat file contents:
makecert -r -pe -n "CN=%1" -b 01/01/2015 -e 01/01/2020 -sky exchange -a sha256 -len 2048 -ss my -sr localMachine
The second script is for creating signing certificates (for things like token signing within a token service such as IdentityServer). Here are the .bat file contents:
makecert -r -pe -n "CN=%1" -b 01/01/2015 -e 01/01/2020 -sky signature -a sha256 -len 2048 -ss my -sr LocalMachine
Or if you simply want these to save the certificate files to the filesystem:
makecert -r -pe -n "CN=%1" -b 01/01/2017 -e 01/01/2025 -sky signature -a sha256 -len 2048 -sv %1.pfx %1.cer
HTH
brockallen 
HI Brock
This link might be interesting as well, shows how to make a cert using makecert or openssl and setup your windows system.
https://damienbod.wordpress.com/2014/04/16/iis-https-configuration-for-team-development/
greetings Damien
Nice — thanks for the link
Any guides you might be aware of that show how to install on IIS 8?
no sorry — i’d check/ask microsoft for into on this.
I compiled letsencrypt-win-simple, and then ran it on my server and it installed automatically a valid IIS 8.5 X509 cert and updated IIS to use it. A full video demo is on this page.
—https://github.com/Lone-Coder/letsencrypt-win-simple/wiki/How-to-Compile-From-Source-Code
Seems only to work with, I have to figure out how to use it with my NON-MS NON-Web based email server.
The github link is here:
—https://github.com/Lone-Coder/letsencrypt-win-simple
And a video explaining how/why you are getting free X509 certs that can auto renew is here:
—https://www.youtube.com/watch?v=OE5UhQGg_Fo
However, I still don’t know much about certs, and am trying to get (automate) a cert with openssl for IdenityServer3, hopefully by tonight.
Hey Brok,
i ‘ve created a little powershell script
$HostNameForCertificate=$env:computername
$AddionalHostNames=”localhost”
$RootCACert=New-SelfSignedCertificate -certstorelocation cert:\localmachine\my -FriendlyName “Local Certification Authority” -TextExtension @(“2.5.29.37={text}1.3.6.1.5.5.7.3.3”) -KeyUsage CertSign -KeyAlgorithm RSA -KeyLength 2048 -dnsname $HostNameForCertificate,$AddionalHostNames
#export cert to import it on other machines in root CAs
Export-Certificate -cert $RootCACert -FilePath c:\temp\root-authority.crt
#add certificate to trusted root certificate authorities
$TrustedRootCAStore= new-object System.Security.Cryptography.X509Certificates.X509Store(“Root”,”LocalMachine”)
$TrustedRootCAStore.open(“MaxAllowed”)
$TrustedRootCAStore.add($RootCACert)
#WebServer Cert
# 1.3.6.1.5.5.7.3.1
New-SelfSignedCertificate -certstorelocation cert:\localmachine\my -FriendlyName “Certificate for Web Server” -TextExtension @(“2.5.29.37={text}1.3.6.1.5.5.7.3.1”) -dnsname $HostNameForCertificate,$AddionalHostNames -Signer $RootCACert
#IdentityServer token signing certificate
#1.3.6.1.5.5.7.3.3
New-SelfSignedCertificate -certstorelocation cert:\localmachine\my -FriendlyName “Certificate for IdentityServer Token Signing” -TextExtension @(“2.5.29.37={text}1.3.6.1.5.5.7.3.3”) -KeyUsage DigitalSignature -KeyAlgorithm RSA -KeyLength 2048 -dnsname $HostNameForCertificate,$AddionalHostNames -Signer $RootCACert
cheers
Michael
When the generated .pfx file is invalid, this solves the issue: https://social.microsoft.com/Forums/en-US/c449501d-57a2-4860-ad26-43af4752be29/the-password-is-incorrect-when-import-pfx-certificate-into-certificate-store?forum=Offtopic