enjay Posted April 23, 2020 Posted April 23, 2020 I'm trying to install an SSL certificate for use in IIS. I'm following the instructions at https://uk.godaddy.com/help/manually-install-an-ssl-certificate-on-my-iis-10-server-27349 (which is where we bought the cert) and get as far as step 30, but can't go on. The certificate seems to install okay, but when you move away from the "server certificates" screen and go back to it, the certificate has disappeared. What am I doing wrong?
chaplic Posted April 23, 2020 Posted April 23, 2020 After running certificate services elevated and selecting computer, can you see the certificate in the personal store, and does it say 'you have a corresponding private key' when you look at properties?
enjay Posted April 24, 2020 Author Posted April 24, 2020 I don't see where you mean, but here's a screenshot of the certificates add-in to MMC (where the instructions said to put it). It is the wildcard one at the top, which is also listed under "Web Hosting", again where the instructions say to install it. So, it looks like it is there, but IIS keeps forgetting it after I do the "complete certificate request"
chaplic Posted April 24, 2020 Posted April 24, 2020 I think the instructions are wrong. The certificate that identifies your website should be in the personal store, and if you double click on it amongst the info it says 'you have a private key that corresponds to the certificate'. Assuming it's there it should be directly pickable in IIS without completing the request.
enjay Posted April 24, 2020 Author Posted April 24, 2020 I think the instructions are wrong. The certificate that identifies your website should be in the personal store, and if you double click on it amongst the info it says 'you have a private key that corresponds to the certificate'. Assuming it's there it should be directly pickable in IIS without completing the request. That would make some sense, as the certs I can see in IIS are in the Personal store. I've installed it to there instead, and can see it in MMC but still not in IIS. Should I have loaded MMC as user, system or computer? I chose Computer. I'm still not seeing the "you have a private key..." bit on Properties though.
chaplic Posted April 24, 2020 Posted April 24, 2020 Youre right being in as computer, but you MUST have the private key, as shown above (as it happens I was updating it today!). The private key is what the content is encrypted with hence why it's not shown in IIS. I would go back to the cert vendor, download the cert, import into personal store again and see what happens.
enjay Posted April 24, 2020 Author Posted April 24, 2020 Sorry, still no joy. So, what I downloaded from cert vendor (Go Daddy) was %random_string_of_characters%.crt, %same_random_string%.pem and gd_g2_iis_intermediate.p7b Installing the p7b file adds Go Daddy root and secure certificate authorities. Installing the .crt file adds a certificate which has the name *.schoolname.com but not the bit about the private key. I tried installing the .cer file which Go Daddy told me to create, but that does the same thing - *.schoolname.com but no mention of a private key. What am I doing wrong? Getting really frustrated with this now (and my wife is tired of hearing me swear at my computer!).
localzuk Posted April 24, 2020 Posted April 24, 2020 How did you generate the certificate request? Did you run something on one of your servers to generate a csr? If so, that server will have the private key part of it all. If not, then GoDaddy should be providing you with a private key.
enjay Posted April 24, 2020 Author Posted April 24, 2020 Didn't generate a request at all. Have I missed a step somewhere?
chaplic Posted April 24, 2020 Posted April 24, 2020 Didn't generate a request at all. Have I missed a step somewhere? Yep, either you create a certificate signing reqest on a webserver which you then give to go daddy, then you complete the request which means the private key is on the server. OR with some cert authorities you say to the CA 'hey just give me a cert for EduGeek.net - The I.T. Professionals' life line' and they give you public and private key which you install.
enjay Posted April 28, 2020 Author Posted April 28, 2020 Yep, either you create a certificate signing reqest on a webserver which you then give to go daddy, then you complete the request which means the private key is on the server. OR with some cert authorities you say to the CA 'hey just give me a cert for EduGeek.net - The I.T. Professionals' life line' and they give you public and private key which you install. I can't see an option in Go Daddy to send them a certificate signing request for this request - despite how their own instructions talk about completing the signing request - nor any download options which give me the keys. I'm really confused! This obviously does work, because other servers have this same wildcard certificate installed, although I think this is the only one doing it through IIS. It expires in August anyway when I'll probably move to letsencrypt, so I might just give up on this for now, we don't need the certificate on this server yet anyway.
chaplic Posted April 28, 2020 Posted April 28, 2020 If you have the certificate installed on another machine, go to that, certificate MMC and export the certificate there as a PKCS7 (needs a password) and ensure the private key is included. Import this onto your target server.
enjay Posted April 29, 2020 Author Posted April 29, 2020 @chaplic you absolute legend, that's working. One slightly odd thing - when I go to https://server.school.com/webapp, I get asked which certificate I'd like to use. I can click "cancel" and go through to the site, but it's odd.
chaplic Posted April 29, 2020 Posted April 29, 2020 Delighted we got there. It sounds to me like in the troubleshooting you've set IIS to require a certificate *of the user* and that's why your web browser is prompting you.
enjay Posted April 29, 2020 Author Posted April 29, 2020 Delighted we got there. It sounds to me like in the troubleshooting you've set IIS to require a certificate *of the user* and that's why your web browser is prompting you. Okay. Where's that setting? I tried the SSL one which says "ignore client certificates" but it still comes up.
chaplic Posted April 29, 2020 Posted April 29, 2020 I don't have a box with Client Certificate Authentication installed to check, but at a guess I'd disable it under Authentication options of the IIS server.
highsky Posted May 2, 2020 Posted May 2, 2020 @chaplic you absolute legend, that's working. One slightly odd thing - when I go to https://server.school.com/webapp, I get asked which certificate I'd like to use. I can click "cancel" and go through to the site, but it's odd. Have you updated the binding on the mentioned site from the IIS manager under sites?
enjay Posted May 4, 2020 Author Posted May 4, 2020 Have you updated the binding on the mentioned site from the IIS manager under sites? Yes, the binding is on HTTPS, uses the certificate and has a host name of site.schoolname.com It isn't the biggest problem in the world, as users can just click past the error, but it is still annoying.
enjay Posted May 4, 2020 Author Posted May 4, 2020 Sorted. I had set the "ignore client SSL certificate" option on server.schoolname.com, but not on the sub-site server.schoolname.com/webapp. Thanks everyone for your assistance.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now