How to sign an IIS SSL certificate request with OpenSSL on Linux

SSL, or Secure Sockets Layer, is a protocol that encrypts data used for transmitting secure information over the Internet. Servers such as Microsoft's Internet Information Server -- IIS -- require proper authorization and unencryption tool for transmitting data sent through SSL. An IIS SSL certificate request must be signed so that encryption and unencryption can take place as needed, securely. Small businesses typically pay money to third parties to facilitate secure communication with their customers. However, you can do it yourself if you have access to a machine with Linux and OpenSSL on it.

Things You'll Need

• A computer
• An IIS SSL certificate request file
• A computer with OpenSSL installed

Instructions

1. Use IIS on your Windows machine to generate your IIS SSL certificate request file, which should be named certreq.txt by default.

2. Transfer this file to your Linux machine using whatever method you like -- put the file on a USB flash drive, email it to yourself or transfer it across the network, for instance.

3. Generate a private key to sign the certificate with. You can use a smaller or larger number of bits, but 2048 bits works well. Enter a pass phrase at the command prompt of your Linux machine as follows:

   # openssl genrsa -des3 -out cakey.pem 2048

4. Create the CA certificate to sign with by typing the following at the command prompt:

   # openssl req -new -key ca.key -x509 -days 9999 -out ca.crt

5. Sign the IIS certificate with the new CA you have just generated:

   # openssl x509 -req -days 9999 -in certreq.txt -CA ca.cer -CAkey ca.key -CAcreateserial -out iis.cer

6. Your new, signed certificate is the file iis.cer. Transfer this file back to the Windows machine, and load it up into IIS. It will remain valid for 9999 days, or about 27 years.

Tips & Warnings

• Remember, all Linux commands are case sensitive.

• When using your certificate, remember that most browsers will pop up a warning saying that the certificate was not signed by a known authority. However, the security is still 100% solid. Because of the warning, this method is not recommended for production websites.

References

• DigiCert: Code Signing Certificate Solutions
• Microsoft: How to Create and Install an SSL Certificate in Internet Information Server 4.0
• Dylan Beattie's Home Page: Creating a Self-Signed Certificate using OpenSSL for use with Microsoft Internet Information Services (IIS) 5