How to install makecert in windows server 2012 R2 running win 10

makecertwindows 10windows-server-2012-r2

i need makecert.exe in our windows server 2012 R2 production machine (win 10).

i read a lot of post and guides that directs me to install the windows SDK.

Makecert missing from Windows 10 and Visual Studio 2015 install?

http://www.virtues.it/2015/08/howto-create-selfsigned-certificates-with-makecert/

the only problem is that when i install the SDK i still can't see the makecer.exe in any of the suggested path (windows search was no luck either)

i know that i can install visual studio to get the makecert but it seems stupid to install 8GB for this little tool. and this is a production machine – VS is a big no no!

what are my options?

any help would be greatly appreciated

p.s. – i know makecert is deprecated but i still need to use it until we'll integrant to the Self-signed certificate generator (PowerShell)

Best Answer

I had the same need for a staging environment, so I generated the certs in a development box (where VS and the makecert tool is installed), exported them, and then imported into the server.

May be important to note that you should not use a self-signed cert in a production environment for security reasons, unless you know exactly what you are doing.

Having said that, below are the steps I followed:

Generate the Root CA and site certificates using the makecert tool in the dev box.
Enter to Window's "Manage Computer Certificates" in the dev box and find the generated certificates (under Trusted Root Cert. Authorities, and Personal Certificates).
Open both certificates, and in the details tab, click "Copy to file" to export the certs. Choose the "Yes, export the private key" option when asked.
Copy the cert files to the server, and double click each certificate to proceed to the import. For the Root CA cert, select the Trusted Root Cert. Authorities store as a destination for the cert to be imported).

Create Certificate Authority

Create a self-signed certificate (-r), with an exportable private key (-pe), using SHA1 (-r), for signing (-sky signature). The private key is written to a file (-sv).

makecert -r -pe -n "CN=My Root Authority" -ss CA -sr CurrentUser ^
         -a sha1 -sky signature -cy authority -sv CA.pvk CA.cer

(^= allow batch command-line to wrap line)

Create Server Certificate

Create a server certificate, with an exportable private key (-pe), using SHA1 (-a) for key exchange (-sky exchange). It can be used as an SSL server certificate (-eku 1.3.6.1.5.5.7.3.1). The issuing certificate is in a file (-ic), as is the key (-iv). Use a particular crypto provider (-sp, -sy).

makecert -pe -n "CN=fqdn.of.server" -a sha1 -sky Exchange ^
         -eku 1.3.6.1.5.5.7.3.1 -ic CA.cer -iv CA.pvk ^
         -sp "Microsoft RSA SChannel Cryptographic Provider" ^
         -sy 12 -sv server.pvk server.cer

pvk2pfx -pvk server.pvk -spc server.cer -pfx server.pfx

You then use the .PFX file in your server app (or install it in IIS). Note that, by default, pvk2pfx doesn't apply a password to the output PFX file. You need to use the -po switch for that.

To make all of your client machines trust it, install CA.cer in their certificate stores (in the Trusted Root Authorities store). If you're on a domain, you can use Windows Group Policy to do this globally. If not, you can use the certmgr.msc MMC snapin, or the certutil command-line utility:

certutil -user -addstore Root CA.cer

To programmatically install the certificate in IIS 6.0, look at this Microsoft KB article. For IIS 7.0, I don't know.

Find makecert.exe? Visual Studio Ultimate 2012

Found it: C:\Program Files (x86)\Windows Kits\8.0\bin\x64

or for Visual Studio 2013: C:\Program Files (x86)\Windows Kits\8.1\bin\x64

Best Answer

Related Solutions

Using makecert for Development SSL

Create Certificate Authority

Create Server Certificate

Find makecert.exe? Visual Studio Ultimate 2012

Related Topic