Creating SSL certificates.

[Dos_Box]

'Sure we can I said', Ooops. Can anyone out there help me out with either:

 

a. Free self certificate creating software

b. A site which creates the for free.

 

We need them for secure (HTTPS) Outlook Web Access to work, and needs to be Windows based.

[Geoff]

Linux with OpenSSL installed. Here's a how:

 

openssl req -new -newkey rsa:1024 -days 365 -nodes -x509 -keyout [url]www.example.com.pem[/url]  -out [url]www.example.com.pem[/url]

 

Enjoy. Just copy the pem file to your windows server when its cooked.

[DMcCoy]

Linux with OpenSSL installed. Here's a how:

 

openssl req -new -newkey rsa:1024 -days 365 -nodes -x509 -keyout [url]www.example.com.pem[/url]  -out [url]www.example.com.pem[/url]

 

Enjoy. Just copy the pem file to your windows server when its cooked.

 

Can also be done on windows with openssl

 

openssl exe is in this apache package:

http://www.madhon.co.uk/modssl/modssl220_vc6.zip

[russdev]

this any good

 

http://itt.theintegrity.net/pmwiki.php?n=ITT.ThawtePersonalEmailCertificates

 

russ

[spc-rocket]

You can use your own dc (which is also i presume the CA for your domain) to do this.

 

Have a look at http://www.isaserver.org for more info on how to do this. Its mostly to do with isa server but had some tutorials to create the certificate.

 

From what i can gather, you need to go into IIS manager and right click on the default website and click on properties.

 

Then go into the "Directory Security" tabe and under the "secure communications" section select the server certificate and follow the wizard.

 

Take a look at this -->http://www.isaserver.org/articles/2004pubowartm.html

 

 

HTH,

 

Ash.

[Dos_Box]

this any good

 

http://itt.theintegrity.net/pmwiki.php?n=ITT.ThawtePersonalEmailCertificates

 

russ

 

Not really. I want a server certificate for HTTPS. Not to certify my mail.

[Dos_Box]

You can use your own dc (which is also i presume the CA for your domain) to do this.

 

Have a look at http://www.isaserver.org for more info on how to do this. Its mostly to do with isa server but had some tutorials to create the certificate.

 

From what i can gather, you need to go into IIS manager and right click on the default website and click on properties.

 

Then go into the "Directory Security" tabe and under the "secure communications" section select the server certificate and follow the wizard.

 

Take a look at this -->http://www.isaserver.org/articles/2004pubowartm.html

 

 

HTH,

 

 

That creates a requst for a certificate. You mail that to a certificate provider and they create your cert from that file.

Ash.

[Geoff]

Try this then:

 

http://www.dylanbeattie.net/docs/openssl_iis_ssl_howto.html

 

Linux solution is less longwinded though

[ChrisH]

I use the method ashok has linked to and its very easy to setup.

 

Edit My own CA issues the certificate though.

[RobC]

If not by Ashok's method, then there should be another method within Server 2k3 to greate your own certificate as I've done it using my Small Business Server to get an SSL certificate for Outlook Web Access & Remote Web Workplace.

[krb548]

I'm on the CASA Course @ Lancaster Uni, the tutor gave us this link a couple of months ago. See if it is of any use.

 

StartCom Free SSL

 

Fantastic. Thanks alot, it works a dream.

[E1uSiV3]

You need to set up a Certificate Authority on your domain and issue yourself a certificate for SSL.

[mitcheln]

The IIS resource kit contains an application called SelfSSL, which I recently used to create a new self-signed certificate for an OWA installation whose certificate had expired. It worked for me.

[Dos_Box]

Now you tell me!!

[eejit]

I need this to work for OWA externally. The selfSSL works great within the domain, but we need something for home users. The security warning in IE7 'looks' much more serious than it did in IE6, any idea how to get a 'proper' certificate? I know absolutely nothing about it - so n00b speak only please

[Geoff]

You need to buy a real certificate.

[eejit]

Cheers Geoff. Are there a few places that you can get those and are they really expensive?

[Geoff]

Verisign, Thwaite or GoDaddy. The price depends on what you want. It varies depending on how many hosts you want, the insurance level and the encryption level.

 

eg, have a look at GoDaddy.

 

https://www.godaddy.com/gdshop/ssl/ssl.asp?ci=418

 

They vary from $20 to $500 a year depending on your requirements.

[eejit]

Cheers Geoff.

Are any/some/most schools doing this already - or are you just putting up with the warning?

[krb548]

Try this link. It is suppossed to be free.

Let me know how you get on as it appears I also need one but have not had the time to try this yet.

Start Com Free SSL Certificates

[Geoff]

We have a full blown PKI infrastructure here, so we can deploy our own CA + Client certs to our machines internally. Thus they trust the server certs implicitly.

 

Our external web access to internally run sites (eg, our VLE running Moodle) is done through a reverse proxy. The SSL cert the clients out on the internet see is from this proxy rather than from our internal web server. So it's not my problem.

 

Sadly CLEO haven't bothered to use a real wildcard cert from *.lancs.sch.uk though so the warning will currently popup.

 

You can see this for yourself, browse to our VLE.

 

https://vle.carrhill.lancs.sch.uk

[eejit]

Try this link. It is suppossed to be free.

Let me know how you get on as it appears I also need one but have not had the time to try this yet.

Start Com Free SSL Certificates

 

Yeah, I saw that on the other page and hoped that someone else had tried it first too

[eejit]

Wow, great looking site Geoff.

[PiqueABoo]

I think if you've got a domain and this is only for staff, then make/use your own CA and get them to your CA cert at home- could have other uses down the line and [don't groan] it's yet another opportunity to try and educate your users about this stuff.

 

Can also be done on windows with openssl

 

I used to routinely build win32 openssl for making a CA and certs for Windows back in the 20th century when the US crackable-crypto export regulations were still a bit serious.

 

[Those regs banned export of strong data encryption but did allow for strong *authentication*. Early non-US Cert Server wouldn't let you have decent key lengths but if you made say a 2048 bit cert via openssl, IIS would happily use it... which was a good thing even though the subsequent SSL data encryption was weak]

[srochford]

We use ipsCA (http://certs.ipsca.com/) who give free SSL certs for education (web site talks about .edu domain; we had no problems getting for a .ac.uk domain and I'd guess they'd be happy with anyone who is demonstrably education).