How to create self signed wildcard (*.example.com) certificate

Question

I'm trying to install Dynamics CRM 2011 RC and configure it for Internet Facing Deployment.

One of the requirements for this is a wildcard SSL certificate. Since I'm installing development/testing server, I don't have a budget for real certificate. So...

What is the easiest way to create Self Signed Wildcard SSL Certificate in Windows?

Solution 1

There isn't an EASY way, but the two that come to mind are:

First, For a web certificate, download the IIS6 Resource Kit tools, and use the SelfSSL.exe tool, choose *.example.com as the name and it will install to the certification database. You should be able to pull out the public/private key and use it however you want.

Second, is a much much harder way, Download the latest version of OpenSSL, and you should be able to generate it through that - I have only ever used it for an entire CA setup and never for a single certificate.

I found instructions for Linux, and it should be similar for Windows. Link here, with a few modifications. If you want help with what is needed for a full CA and/or can't find what you need, let me know and I'll try to find it out for you.

Solution 2

There is an easy way in IIS!

Just launch IIS Management, select the server node and double-click the Certificates feature. Next, on the right side, click "Create Domain Certificate ..."

Comments

[Admin]

there are myriad options in linux that are EASY like tinyca...you could use the openssl executable on windows to do this, but it's a bit more complicated

[Admin]

Easy linux solutions are also appreciated! I do have some virtual Ubuntu images lying around...

[anger]

Tnx, Wil. It worked as a charm. Somehow I was underimpression that IIS 7 built in "create self-signed certificate" is the same as IIS resource kit tool. But obviously is not!

[William Hilsum]

@David - the IIS7 tool is much easier for... creating self signed SSL certificates, however, the selfssl.exe from the toolkit is a lot more flexible and customisable. I do not know if there is anyway to manipulate/customise the IIS7 version, however, the IIS6 version does everything I need, so I nearly always end up going back to it.

[Dot_NET Pro]

How can we specify SAN in Domain Certificate ?

[Mog0]

Looks like the link for IIS6 Resource Kit Tools is broken