Click here to Skip to main content
Click here to Skip to main content
Search within:




 
Comments & Discussions (30)

4 steps to create free SSL certificate for development

By , 4 May 2009
 

4 steps to create free SSL certificate for development

Introduction and Goal

Step 1 :- Locate makecert.exe

Step 2:- Create the certificate

Step 3 :- Assign the certificate to the site

Step 4:- Test the site

Step 5 :- Find a nice restaurant

SSL diagnostic tool

Introduction and Goal
 

There are times where we would like to have SSL enabled in our development environment. SSL certificates needs to be bought from places like Thawte, Verisign, GeoTrust etc. Typical cost of SSL certificate is shown below.
 

Description

Certificate

Setup Fee

Recurring Fee

Total

Month 1

$27.95

$25.00

$9.00

$61.95

Every quarter

$0.00

$0.00

$9.00

$9.00

Once every 12 months

$27.95

$0.00

$0.00

$27.95

This means you also need to buy SSL certificate for your development server. This cost can double if you also setup of development and testing environment. So this article will save you 100$ atleast . Microsoft has provided ‘makecert.exe’ tool which helps us to create test certificates for our development environment.

Now a days I am distributing my 400 questions and answers eBook which covers major .NET related topics like WCF,WPF,WWF,Ajax,Core .NET,SQL Server,Architecture and lot lot more. I am sure you will enjoy this eBook.
http://www.questpond.com/SampleDotNetInterviewQuestionBook.zip
 

Step 1 :- Locate makecert.exe
 

The first thing is to locate makecert.exe. You can get the same from “C:\Program Files\Microsoft Visual Studio 8\Common7\Tools\Bin” or you can also get it from windows SDK.

Let’s run through what is “makecert.exe” and the explanation of different parameters. I admit this section I have shamelessly copied from http://msdn.microsoft.com/en-us/library/dd434713.aspx 

MakeCert (Makecert.exe) is a command-line tool that creates an X.509 certificate that is signed by a system test root key or by another specified key. The certificate binds a certificate name to the public part of the key pair. The certificate is saved to a file, a system certificate store, or both.

Below is a detail list of how to use make cert
 

MakeCert [/b DateStart] [/e DateEnd] [/m nMonths] [/n "Name"] [/pe] [/r] [/sc SubjectCertFile] [/sk SubjectKey] [/sr SubjectCertStoreLocation] [/ss SubjectCertStoreName] [/sv SubjectKeyFile] OutputFilePartial list of switches and arguments

/b DateStart
Specifies the start date when the certificate first becomes valid. The format of DateStart is

mm/dd/yyyy.
If the /b switch is not specified, the default start date is the date when the certificate is created.

/e DateEnd
Specifies the end date when the certificate’s validity period ends. The format of DateEnd is

mm/dd/yyyy.
If the /e switch is not specified, the default end date is 12/31/2039.

/m nMonths

Specifies the number of months starting from the start date during which the certificate will remain valid.

/n "Name"
Specifies a name for the certificate. This name must conform to the X.500 standard. The simplest method is to use the "CN=MyName" format.
If the /n switch is not specified, the default name of the certificate is "Joe's Software Emporium".

/pe
Configures MakeCert to make the private key that is associated with the certificate exportable.

/r
Configures MakeCert to create a self-signed root certificate./sc SubjectCertFile
Specifies the subject's certificate file name along with the existing subject public key that is used.

/sk SubjectKey
Specifies the name of the subject's key container that holds the private key. If a key container does not exist, a new key container is created. If neither /sk nor /sv switch is entered, a default key container is created and used by default.

/sr SubjectCertStoreLocation
Specifies the registry location of the certificate store. The SubjectCertStoreLocation argument must be either of the following:
currentUser
Specifies the registry location HKEY_CURRENT_USER.
localMachine
Specifies the registry location HKEY_LOCAL_MACHINE.
If the /r switch is not specified along with the /s switch, currentUser is the default.

/ss SubjectCertStoreName
Specifies the name of the certificate store where the generated certificate is saved.

/sv SubjectKeyFile
Specifies the name of the subject's .pvk file that holds the private key. If neither /sk nor /sv switch is entered, a default key container is created and used by default.
OutputFile
The name of the file in which the generated certificate is saved.
 

Step 2:- Create the certificate
 

The second step is to create the certificate. You can type the below thing through your dos prompt on “C:\Program Files\Microsoft Visual Studio 8\Common7\Tools\Bin”. Please note “compaq-jzp37md0” is the server name so you need to replace with your PC name.
 

makecert -r -pe -n "CN= compaq-jzp37md0 " -b 01/01/2000 -e 01/01/2050 -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localMachine -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12

If you run the same through your command prompt you should get a succeeded message as shown below.
 

 

Step 3 :- Assign the certificate to the site
 

Now it’s time to assign this certificate to your IIS website. So go to IIS properties , click on directory security tab and you should see server certificate tab.
 

 

So click on the server certificate tab and you will then be walked through a IIS certificate wizard. Click ‘Assign a existing certificate’ from the wizard.

You can see a list of certificates. The “compaq-jzp37md0” certificate is the one which we just created using ‘makecert.exe’.

 

Step 4:- Test the site


Now try to test the site without ‘https’ and you will get an error as shown below….That means your certificate is working.
 

 

Step 5 :- Find a nice restaurant
 

Now that you have saved 100$ find a nice restaurant to burn it… 
 

SSL diagnostic tool
 

There is a other easy way also using the SSL diagnostic tool. Download this tool from http://www.microsoft.com/downloads/details.aspx?familyid=CABEA1D0-5A10-41BC-83D4-06C814265282&displaylang=en  and create new cert on the IIS application with just a click as shown below.
 

Image courtesy :- http://pranas.net/Tutorials/ssl/SSLDiagnostics.htm

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

About the Author

Shivprasad koirala
Architect http://www.questpond.com
India India

I am a Microsoft MVP for ASP/ASP.NET and currently a CEO of a small
E-learning company in India. We are very much active in making training videos ,
writing books and corporate trainings. Do visit my site for 
.NET, C# , design pattern , WCF , Silverlight
, LINQ , ASP.NET , ADO.NET , Sharepoint , UML , SQL Server  training 
and Interview questions and answers


Article Top
 
Sign Up to vote   Poor Excellent
Add a reason or comment to your vote: x
Votes of 3 or less require a comment

Comments and Discussions

 
You must Sign In to use this message board.
Search this forum  
    Spacing  Noise  Layout  Per page   
First Prev Next
QuestionMy Vote Of 4memberAlireza_13626-Dec-12 16:46 
Thanks for sharing
Sign In·View Thread·Permalink
Suggestionuseful for a begineermemberbaksh28-Nov-12 3:12 
The content is very well organized and was very useful for a begineers
test
Sign In·View Thread·Permalink
GeneralMy vote of 5memberMartin Lottering27-Aug-12 1:19 
Great help. Thanks.
Sign In·View Thread·Permalink
QuestionfeedbackmemberAndroid Parth20-Mar-12 2:26 
It was very helpful to me..thanks !
Sign In·View Thread·Permalink
GeneralMy vote of 4memberMember 43208446-Jan-12 0:57 
Thanks a lot.
Sign In·View Thread·Permalink
GeneralMy vote of 5memberSATYA NARAYAN SAHOO28-Jul-11 7:43 
My vote 5
Sign In·View Thread·Permalink
GeneralMy vote of 5memberVivek Johari9-Jan-11 4:04 
good and helpful...Smile | :)
Sign In·View Thread·Permalink
GeneralMy vote of 5memberAbdullahSoft19-Nov-10 22:54 
I found this article very helpful for me
Sign In·View Thread·Permalink
GeneralMy vote of 5memberRudru15-Sep-10 17:58 
Good article
Sign In·View Thread·Permalink
GeneralthanksmemberBrisa Argelia22-Mar-10 8:32 
I need a certificate for a quick test in my development server and this do it.
 
Thanks.
 
And of course, it's only for tests Smile | :)
Only a fool will think a certificate made by himself will
be trusted/useful in production
 

Thanks
Sign In·View Thread·Permalink
NewsAn easy way to create a self Signed Certificate with OpenSSLmemberElmue21-Jul-09 7:09 
Hello
 
If you want to generate a self signed Certificate via OpenSSL (e.g. in Xampp)
I found two good tutorials:
 
english: http://www.akadia.com/services/ssh_test_certificate.html
and
german: http://portal.uni-freiburg.de/rz/dienste/pki/docu/s-req/openssl
 
To check the encrypted content of your certificate paste it into:
https://pkiwidgets.quovadisglobal.com/pkiwidgets/decodeCert.aspx
 
I wrote a batch script which does all the stuff automatically.
It uses a config file where you have to enter your data.
 
If you need a PEM file copy the output files Server.key and Cert.crt into one file.
 
If you need a certificate which is valid for:
blog.mycompany.com
email.mycompany.com
web.mycompany.com
 
you have to set in Cert.config:
CN      *.mycompany.com
CreateCert.bat
@cls
@SET OpenSSL=C:\Program Files\xampp\apache\bin\openssl.exe
 
@echo ####################################################################
@echo When the script runs you have to enter 3 times the same password.
@echo It can be anything of 4 characters. 
@echo The password will later be removed from the keys.
@echo You will find the certificate in the folder where this script runs.
@echo See http://www.akadia.com/services/ssh_test_certificate.html
@echo and http://portal.uni-freiburg.de/rz/dienste/pki/docu/s-req/openssl
@echo and https://pkiwidgets.quovadisglobal.com/pkiwidgets/decodeCert.aspx
@echo ####################################################################
@echo.
@echo --------------------------
@echo Create Server Private Key
@echo --------------------------
"%OpenSSL%" genrsa -des3 -out serverPass.key 2048
 
@echo --------------------------------
@echo Remove Password from Server Key
@echo --------------------------------
"%OpenSSL%" rsa -in serverPass.key -out server.key
del serverPass.key
 
@echo -----------------------------
@echo Generate Certificate Request
@echo -----------------------------
"%OpenSSL%" req -new -key server.key -out Cert.csr -config Cert.config
 
@echo ---------------------------------------------
@echo Self-Sign Certificate Request to Certificate
@echo ---------------------------------------------
"%OpenSSL%" x509 -req -days 1825 -in Cert.csr -signkey server.key -out Cert.crt
Cert.config
[ req ]
default_bits           = 2048
distinguished_name     = req_distinguished_name
prompt                 = no
 
[ req_distinguished_name ]
C                      = DE
O                      = Universitaet Freiburg
OU                     = Rechenzentrum
CN                     = server1.uni-freiburg.de
emailAddress           = admin@server1.uni-freiburg.de
Elmü
Sign In·View Thread·Permalink
GeneralGenerated on VIsta and exported to Win2003membervalamas24-May-09 1:04 
Hi,
 
Excellent article 5/5. Sorry to read others misunderstand the concept of a free ssl certificate for development and testing. (My favorite restaurant makes hottest Vindaloo.)
 
Here is how I followed your instruction and my slight deviation.
 
I needed to have the certificate on my test windows 2003 box. I did not want to install Visual Studio on it. So what i did was generate the certificate on my Vista machine via directory
C:\Program Files\Microsoft Visual Studio 8\SDK\v2.0\Bin
and use the similar makecert.exe command and changed the name of the server as you suggested.
 
On my Vista machine, i then opened IIS7, click on my machine name / server certificates (in the main festure view). The certificate i created was there and i exported it to *.pfx file using a simple password. Copied it to my win2003 box.
 
I then open iis6 on my win2003 box. Properties of website i want to have ssl, directory security tab / server certificate button / next / import from pfx file.... and the rest people can figure out. After that I added port 443 to the home tab. Click ok and surf to the site using https.
 
I dont't care that a warning shows for invalid or expired certificate. This is for testing.
 
SOOOOOO easy. Thank you, have a nice day.
Sign In·View Thread·Permalink
GeneralOther waysmemberWiebe Tijsma12-May-09 1:20 
Hi,
 
Thanks for your article!
 
I have never figured out how to use that tool, I always did it a bit differently:
 
When using IIS6.0, you can use SelfSSL from the IIS 6.0 resource kit tools[^] that will perform most of the steps in this article with 1 command.
 
In IIS7.0, creating a self-signed certificate is part of the IIS manager, just click 'Certificates'>'Create Self Signed Certificate'.
 
Thanks,
 
Wiebe
 
------------------------------
spoon? what spoon?
 
http://www.netindustry.nl
Sign In·View Thread·Permalink
GeneralRe: Other waysmemberskantg14-Feb-12 0:11 
I tried all these ways and then found that, in both these ways one will encounter problem when he needs to create self signed certificate which is valid for a domain not a particular site(wildcard certificate).
In my views makecert is the best utility for this purpose.
Sign In·View Thread·Permalink
GeneralBit HarshmemberTim Grindley12-May-09 1:01 
I have already worked out how to do this process, but your article would have been very useful at the time I was researching. With regards the comments about misleading etc I think they are a bit harsh. SSL is not new and paid for certificates have been around for a long time. I wouldn't make development decisions on one article alone.
 
Anyway, thanks for your input, Code Project is the better for it.
Sign In·View Thread·Permalink
General[Message Deleted]membericestatue4-May-09 2:21 

Sign In·View Thread·Permalink
GeneralRe: Completely inaccurate and misleading article.memberShivprasad koirala4-May-09 2:40 
Dear read properly where i have written you need to use it in production its for dev environment and testing.
 
Footprints on the sand are not made by sitting at the shore.
Sign In·View Thread·Permalink
GeneralRe: Completely inaccurate and misleading article.memberSteven Relis21-Jun-09 2:17 
It shows how to make a test certificate. It's useful. You are not.
Sign In·View Thread·Permalink
GeneralRe: Completely inaccurate and misleading article.membermjanulaitis123416-Dec-09 4:39 
So you are telling us data transmitted with a self-signed certificate is in the clear and not encrypted? If so then agreed. But I don't think so and I don't care about doing a packet trace because I know the data is encrypted meaning that yes you can use self-signed certs in a prod environment. The problem is you think prod means publicly used server. There are lots of reasons to use computers and to think the only reason is to host a web site on the internet is crazy talk. Get some experience before you voice your opinion.
Sign In·View Thread·Permalink
GeneralMy vote of 1membericestatue4-May-09 2:18 
This article is misleading and completely inaccurate.
Sign In·View Thread·Permalink
GeneralRe: My vote of 1membersenorbadger31-Aug-10 2:00 
care to explain?
Sign In·View Thread·Permalink
GeneralReally useful articlemembersaanj3-May-09 23:22 
Thanks Shiv for sharing such an useful article.
 
Either you love IT or leave IT...
Sign In·View Thread·Permalink
GeneralGood onememberAbhishek Sur3-May-09 22:30 
I know the makecert.exe already. but never tried that .. I think I should try it now...
 
Thanks for the article. Rose | [Rose] Rose | [Rose]
 
Abhishek Sur

My Latest Articles
Basics on LINQ and Lambda Expressions

Create .NET Templates
Sign In·View Thread·Permalink
GeneralMy vote of 2memberTalking Clipboard3-May-09 21:22 
No content, much graphics.
The certificate is invalid, as not signed by Root CA.
Sign In·View Thread·Permalink
GeneralRe: My vote of 2memberShivprasad koirala3-May-09 22:07 
I am not saying you are wrong....Just defending why i have written this article.
Talking Clipboard wrote:
The certificate is invalid, as not signed by Root CA.

 
It free so it will not be valid.In the article also i have no where written it will be a valid one. Its just for testing
 

Talking Clipboard wrote:
No content, much graphics.

 
Its hardly four steps...No content as such. Goal of the article was to make aware of the makecert.exe which helps to test your site using https.
 
Thanks for your input
 
Footprints on the sand are not made by sitting at the shore.
Sign In·View Thread·Permalink
GeneralRe: My vote of 2memberAlexey Prosyankin4-May-09 2:37 
Shivprasad koirala wrote:
Talking Clipboard wrote:
The certificate is invalid, as not signed by Root CA.
 

 
It free so it will not be valid.In the article also i have no where written it will be a valid one. Its just for testing
 

 
But really how anybody can earn 100$ as you have written in the title of this article? If this article show the way ONLY for testing purpose. It's like a lying advertise, isn't it?
Sign In·View Thread·Permalink
GeneralRe: My vote of 2memberShivprasad koirala4-May-09 2:45 
You save from not buying the cert for prod and dev. One of the things which i have noticed is testing in with http and with https have significant differences. I have seen show stopper defects when application starts running on https in live.
 
Ok i agree to your point its a advertise....but definetly not a lying advertise.
 
Footprints on the sand are not made by sitting at the shore.
Sign In·View Thread·Permalink
GeneralRe: My vote of 2memberShivprasad koirala4-May-09 2:52 
Ok i have taken your point and removed that 100$.....Does not suit the article anywhere.
 
Thanks....
 
Footprints on the sand are not made by sitting at the shore.
Sign In·View Thread·Permalink
GeneralRe: My vote of 2membersupercat94-May-09 12:16 
It free so it will not be valid.In the article also i have no where written it will be a valid one. Its just for testing
 
Perhaps it would be good if you make clear the limitations of free certs, the most notable being that browsers must be manually configured to accept the certificate or they will squawk. This limitation won't generally be a problem with beta testers who are willing to trust your certificate, but real users wouldn't (or at least shouldn't) be willing to entrust confidential information to what seems to be your site absent some means of ensuring the certificate claiming to come from your site actually does.
Sign In·View Thread·Permalink
GeneralRe: My vote of 2 - Not signed by Root CAmemberptmcomp12-May-09 7:48 
If you just need to be able to run SSL, a self signed certificate can do. If you need a proper certificate, but still only for development (or internal communication) purposes, you can use openssl to create your own root certificate and then a proper server certificate which is signed by your Root CA. You will need to install your Root CA on the server and in the browser. But then it is recognized as valid certificate and you won't get any annoying security warnings anymore. Of course you need to make sure that your CA is safe or your test system is isolated else someone could issue his own certificate signed by your CA. All the machines which have your Root CA Certificate installed will trust all the certificates signed by our CA!
Sign In·View Thread·Permalink
Last Visit: 31-Dec-99 18:00     Last Update: 17-Jun-13 17:27Refresh1

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

About Article
4 steps to create free SSL certificate for development
Type Article
Licence CPOL
First Posted 3 May 2009
Views 128,680
Bookmarked 163 times

, +
Top News

Skills that self-taught computer programmers lack

Get the Insider News free each morning.
Related Videos
SSL/TLS client/server for .NET and SSL tunnelling
How to Create SSL Secure Server (HTTPS) in Local IIS?
How to Configure SSL Certificate for SharePoint Web Application on IIS7/Window Server 2008
How to Configure SSL Certificate for the Central Administration Web Site of SharePoint Server 2010
SSL : Convert your Plain Sockets to SSL Sockets in an Easy Way
Securing My Website Using SSL in Local IIS (5.1 and Above)?
6 Steps to Implement DUAL Security on WCF using User name + SSL
IIS Admin Base Object Wrapper for installing SSL Certificates
IIS Admin Base Object Wrapper for installing SSL Certificates
An Introduction to Mutual SSL Authentication
Create an SSL Site in SharePoint 2010
CAsyncSslSocketLayer - SSL layer class for CAsyncSocketEx
Debugging SSL on Both iOS Devices and Simulators with Man-in-the-middle Proxies
Using authentication certificates to connect to web services with Windows form applications
Securing WCF Services with Certificates
One Click SSL Certificate Registration using WinHTTP
Bypass and Restore SSL Certificate Validation in VB.NET
Seven simple steps to enable HTTPS on WCF WsHttp bindings
Simple Instant Messenger with SSL Encryption in C#
Demystify http.sys with HttpSysManager
Permalink | Advertise | Privacy | Mobile
Web04 | 2.6.130617.1 | Last Updated 4 May 2009
Article Copyright 2009 by Shivprasad koirala
Everything else Copyright © CodeProject, 1999-2013
Terms of Use
Layout: fixed | fluid