Thursday, March 29, 2007

x509 Certificates

How do you create a self signed certificate (for SSL) that (don't know how best to put it) carries it's password with it. It is just for testing, I just want the certificate the be used by the server in its call to AuthenticateAsServer. I (eventually) was able to create a self signed Root Authority certificate like this:

makecert -n "CN=Test Root Authority" -r -pe -ss my -sr LocalMachine -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 TestRootAuthority.cer

and from it create a self signed certificate:

makecert -n "CN=Test Certificate" -in "Test Root Authority" -pe -ss my -sr LocalMachine -is my -ir LocalMachine -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 Test.cer

Which works, as long as the server runs on a machine where the certificate is installed in the certificate store. It will not work if I try to just use the Test.cer file. That gives me:

The server mode SSL must use a certificate with the associated private key.

Regardless, I am still seeing the http connection attempt (that I am assuming to be a revocation list check or something) that I am trying to avoid. (thread on microsoft.public.dotnet.security)

Oh I don't know...

No comments:

Post a Comment