Wildcard SSL Certificate

[edie209]

We have bought a wildcard SSL certificate from Go Daddy.

 

We need to use SSL certificates on 3 servers 1 Exchange 2007 and two IIS 7 web Servers and at a later date Office 365. I created the CSR on the Exchange server

 

New-ExchangeCertificate -generaterequest -keysize 2048 -subjectname "c=GB, l=town, s=County, o=Organisation,cn=school.sch.uk" -domainname SubjectAltern
1, SubjectAltName2, SubjectAltName3, SubjectAltName4 -PrivateKeyExportable $true -path c:\certrequest.txt

 

This has worked great on the Exchange server but when I come to the first IIS7 webserver

 

I select "Complete Certificate Request" and I get this error

 

I spoke to Go Daddy and was told I need to by another Cert for each server, well that's not really going to happen and I am sure this can be done looking on the web.

 

I found this solution for that error http://blogs.msdn.com/b/webtopics/archive/2009/01/03/asn1-bad-tag-value-met-error-when-processing-a-certificate-request-in-iis-7.aspx

 

Begin by importing the .crt file into the Personal certificate store for the local computer. (Start button > Run:  MMC > File Menu > Add/Remove Snap-in > highlight Certificates snap-in and click the ADD button > select Computer Account and click Finish >  Click OK > drill into Personal > Certificates >  right-click and select All Tasks > select Import > guide to the .crt file.)  At this point your certificate is basically a half-certificate.  It is still missing its private key.

Second, double-click the crt certificate file you just imported, select the Details tab, scroll all the way down to Thumbprint and highlight Thumbprint.  In the lower pane, block and copy all the letters of the thumbprint.  Paste the thumbprint characters into notepad.  Open the command prompt and run this command: Certutil /?
The command you’ll want to run is:

certutil -repairstore my "{insert all of the thumbprint characters here}"

When you see the response: “CertUtil: -repairstore command completed successfully” you should have a private key associated with the .crt file in the personal store. There should no longer be any need to run through the “Complete Certificate Request…” wizard.  The certificate should show up in the IIS Manager’s list of server certificates at this point.  It should also be available in the SSL Certificates drop-down list when attempting to edit the https binding for a website.  

 

However I get "Access Denied" even with elevated privileges.

 

C:\Windows\system32>certutil -repairstore my "7c 46 56 c3 06 1f 7f 4c 0d 67 b3 19 a8 55 f6 0e bc 11 fc 44"
my
================ Certificate 0 ================
Serial Number: 0301
Issuer: OU=Go Daddy Class 2 Certification Authority, O=The Go Daddy Group, Inc.,
C=US
NotBefore: 16/11/2006 01:54
NotAfter: 16/11/2026 01:54
Subject: SERIALNUMBER=00000000, CN=Go Daddy Secure Certification Authority, OU=h
ttp://certificates.godaddy.com/repository, O=GoDaddy.com, Inc., L=Scottsdale, S=
Arizona, C=US
Non-root Certificate
Cert Hash(sha1): aa aa aa aa aa aa aa aa aa aa aa aa a8 55 f6 0e bc 11 fc 44
No key provider information
Cannot find the certificate and private key for decryption.
CertUtil: -repairstore command FAILED: 0x80090010 (-2146893808)
CertUtil: Access denied.

 

To which I found this soulution Add a certification authority backup operator: Public Key

 

[b]To add a certification authority backup operator[/b]

[color=#2A2A2A][font=Segoe UI]
[list]
[*]Open Local Security Settings.
[*]In the console tree, click [b]User Rights Assignment[/b].

[b]Where?[/b]
[list]
[*]Security Settings/Local Policies/User Rights Assignments
[/list]

[*]In the details pane, double-click [b]Back up file and directories[/b].
[*]Click [b]Add User or Group[/b] and, in [b]Enter the object names to select[/b], type the name of the user or group to add as a backup operator, and then click [b]OK[/b].
[*]In the details pane, double-click [b]Restore file and directories[/b].
[*]Click [b]Add User or Group[/b] and, in [b]Enter the object names to select (examples)[/b], type the name of the user or group to add as a backup operator, and then click [b]OK[/b].
[/list]
[/font][/color]

 

But now I am stuck and not sure what the next step is has anyone had a situation like this and how did you overcome it. As I said Go Daddy have been no help on this, do I need to rekey and start again is it possible just a bad cert?

[sukh]

So you're just importing the wild cert straight into IIS?

 

Anything on the app log?

[diagdave]

You can't import the certificate easierly onto another machine with the reply from godaddy. Just export the completed certificate request from your exchange server including the private key into a pfx file then import that into iis onto your other server.hope it helps d

[edie209]

Well what a day can do, @diagdave I have tried to export the cert yesterday from the exchange server many times yesterday with no option for pfx it was all greyed out. Came in this morning and read your post and thought what the hell lets try it this way again, and would you believe it it worked first time????? I went into IIS7 and imported it fine.

 

Thanks for the replies