Internal IIS site - Trusted SSL

[CHiLL]

Does anyone know if it's possible to use an internal CA to create an SSL certificate for an internal website, so that our computers trust it and don't prompt an invalid certificate? If it is possible, can someone provide some basic info as to how?

[TechMonkey]

Yes, as long as you distribute your CA Root certificate to all devices as a trusted publisher. Can be done with GPO or Intune.

 

Personally I would move away from that though and get an external cert if possible as any device will trust it then, even if it is a wildcard cert so it can be used in multiple places. Does depend on you having an externally resolvable FQDN though.

[dmj]

Does anyone know if it's possible to use an internal CA to create an SSL certificate for an internal website, so that our computers trust it and don't prompt an invalid certificate? If it is possible, can someone provide some basic info as to how?

 

That's literally what they are for.

 

FWIW I partially agree with @TechMonkey to use an external certificate - but I'm not so keen on using wildards. I would advocate adding the internal machines as SAN to the certificates. Certificates can be generated per host with ACME https://en.wikipedia.org/wiki/Automatic_Certificate_Management_Environment

[CHiLL]

Yes, as long as you distribute your CA Root certificate to all devices as a trusted publisher. Can be done with GPO or Intune.

 

Personally I would move away from that though and get an external cert if possible as any device will trust it then, even if it is a wildcard cert so it can be used in multiple places. Does depend on you having an externally resolvable FQDN though.

 

That's literally what they are for.

 

FWIW I partially agree with @TechMonkey to use an external certificate - but I'm not so keen on using wildards. I would advocate adding the internal machines as SAN to the certificates. Certificates can be generated per host with ACME https://en.wikipedia.org/wiki/Automatic_Certificate_Management_Environment

I can see that our is already in all our client's Trusted Root Certification Authorities > Certificates. It isn't being pushed by GP, so I assume it's listed in the directory and added via auto-enrollment. However, that's been the case for many, many years and all our sites with self-signed certificates are still untrusted.

[jthompson]

Self-signed and signed by the internal CA are different things, aren't they?

[CHiLL]

Self-signed and signed by the internal CA are different things, aren't they?

That's what I thought, but I've started to confuse myself. I've created a Domain Certificate within IIS on the web server and bound that to port 443. It's now complaining that the common name is invalid on both Edge and Chrome: NET::ERR_CERT_COMMON_NAME_INVALID.

[TechMonkey]

I've had to battle with this multiple times and someday I will write it down.

 

It is something like when you generate the certificate browsers now expect SAN name to match, and CAs don't have this by default

[Cw2k]

That's what I thought, but I've started to confuse myself. I've created a Domain Certificate within IIS on the web server and bound that to port 443. It's now complaining that the common name is invalid on both Edge and Chrome: NET::ERR_CERT_COMMON_NAME_INVALID.

 

That error is usually due to the domain in the CN field not being duplicated in the SAN field.

[CHiLL]

That error is usually due to the domain in the CN field not being duplicated in the SAN field.

It's not showing me a SAN field (unless it's called something else). I'm specifically using the Create Domain Certificate option in IIS > Server Certificates.

 

CN: website.school.sch.uk

Organisation: school name

Organisation unit: blank

City/locality: Birmingham

State/province: West Midlands

Country/region: GB

 

Specify Online Certification Authority: Internal CA

Friendly name: website.school.sch.uk

 

We have internal DNS records for website.school.sch.uk and I've also tried replacing website.school.sch.uk with website.domain.local, but that certificate shows the same error.

Edited September 8, 2023 by CHiLL

[TechMonkey]

I think this is the guide I used after searching windows ca san attribute.

[CHiLL]

I think this is the guide I used after searching windows ca san attribute.

Thank you very much for this. Following this guide has allowed me to create and install a certificate that works! (I never knew that webpage for the CA existed!)

[eddyc]

I think this is the guide I used after searching windows ca san attribute.

 

Sorry to drag up an old post but in addition to my thanks, I wanted to thank you via message! I have been banging my head against a brick wall for ages trying to achieve this and now all of our internal sites are using SSL. Thanks!