Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Trust a self signed cert from IIS

I have an externally hosted iis webserver where i run my website. I would like to add a self signed certificate to this website and trust it on my local client, to remove "Insecure Connection" from the browser.

What i have done so far is the following

  1. Created a self signed certificate in IIS: Server Certificates -> Create self signed Certificate. The cert is issued to the servername e.g "ABCD01"
  2. Created a website with a https binding using the self signed certificate.
  3. Exported the self signed certificate from IIS using: Server Certificates -> Export. This resulted in an .pfx file
  4. Imported the .pfx cert file on the local client: manage computer certificates -> Trusted Root certification authorities -> import
  5. Added the hostname (ABCD01) and ip of the host to the hosts file: C:\Windows\System32\drivers\etc\hosts

When i try to open the website in firefox (using https://ABCD01), i still get the "Your connection is not secure". What am i missing?

like image 667
Thomas Schneiter Avatar asked Oct 09 '17 08:10

Thomas Schneiter


People also ask

How do I trust a self-signed certificate in IIS Windows server 2019?

In IIS Manager, do the following to create a self-signed certificate: In the Connections pane, select your server in the tree view and double-click Server Certificates. In the Actions pane, click Create Self-Signed Certificate. Enter a user-friendly name for the new certificate and click OK.

Can self-signed certificate be trusted?

Self-signed certificates are safe in a testing environment, and you can use them while you are waiting for your certificates officially signed by CAs. But, using them in a production environment leaves the systems exposed to vulnerabilities and security breaches.

How to create self signed certificate in IIS?

Created a self signed certificate in IIS: Server Certificates -> Create self signed Certificate. The cert is issued to the servername e.g "ABCD01" Created a website with a https binding using the self signed certificate.

How do I Configure my computer to trust IIS Express certificates?

To configure your computer to trust the IIS Express certificate, use the following steps: Note: You can also open a blank Microsoft Management Console by typing "mmc" from a command prompt and pressing the Enter key. When the Add or Remove Snap-ins dialog box is displayed, click Certificates, and then click Add:

Are self-signed certificates for HTTPS really trusted?

Since that certificate is self-signed, it is not trusted as if it was issued from a "Trusted Root Certification Authority," and therefore Internet Explorer (or any other security-conscious web browser) was doing the right thing by warning the end-user that they were using an untrusted certificate for HTTPS.

How to bind a self signed certificate to the default site?

The validity of the Self Signed Certificate is one year. The next step is to bind the certificate to the default web site. 7. Browse to the Connections column on the left-hand side, expand the Sites folder and click on the website you wish to bind the SSL certificate to. In this case, we want to bind the certificate to the default web site. 8.


Video Answer


1 Answers

There are multiple issues:

  1. IIS certificate generator creates self-signed certificates with SHA1 signature algorithm which is obsolete in modern browsers. You have to use different tools to create test certificates. For example, use PowerShell New-SelfSignedCertificate cmdlet where you can specify signature algorithm. Look at this post to get an example: https://stackoverflow.com/a/45284368/3997611
New-SelfSignedCertificate `
    -DnsName "ABCD01" `
    -CertStoreLocation "cert:\LocalMachine\My" `
    -FriendlyName "test dev cert" `
    -TextExtension "2.5.29.37={text}1.3.6.1.5.5.7.3.1" `
    -KeyUsage DigitalSignature,KeyEncipherment,DataEncipherment `
    -Provider "Microsoft RSA SChannel Cryptographic Provider" `
    -HashAlgorithm "SHA256"
  1. IIS certificate generator cannot build certificate with SAN (Subject Alternative Names) certificate extension which is required in Google Chrome. You have to use different tools to create test certificates. Look at the example above for reference.

  2. Google Chrome uses built-in Windows Certificate store to establish a trust, while FireFox uses its own certificate store. Therefore, after adding the certificate to Windows certificate store, you have to import your test certificate to FireFox manually.

like image 133
Crypt32 Avatar answered Sep 29 '22 02:09

Crypt32