99

Since I'm very new to SSL certificates, and the creation and usage of them I figured maybe StackOverflow members can help me out.

I'm from Holland, the common way of online payments is by implementing iDEAL. An online payment protocol supported by the major banks. I have to implement a 'professional' version. This includes creating a RSA private key. Based on that key I have to create a certificate and upload it to the webserver.

I'm on a Windows machine and completely confused what to do. I took a look at the OpenSSL website, because the manual forwarded me to that website to get a SSL Toolkit.

The manual provides two commands which have to be executed in order to create a RSA key and a certificate.

The commands are:

openssl genrsa -des3 –out priv.pem -passout pass:myPassword 1024

and

openssl req -x509 -new -key priv.pem -passin pass:myPassword -days 3650 -out cert.cer

Is there a way I can do this by a utility on a windows machine? I've downloaded PuTTy KeyGenerator. But I'm not sure what to do, I've created a key (SSH-2 RSA, whatever that is..) but how do I create a certificate with that key?

Volodymyr
  • 1,209
  • 1
  • 15
  • 26
Ben Fransen
  • 10,884
  • 18
  • 76
  • 129
  • 1
    See question [Way to run Bash scripts on Windows](https://stackoverflow.com/q/6413377/7794769) – stomy Apr 23 '18 at 17:59
  • See [PUTTYGEN - KEY GENERATOR FOR PUTTY ON WINDOWS](https://www.ssh.com/ssh/putty/windows/puttygen) – stomy Apr 23 '18 at 20:24
  • Here you can create self-signed certificate online: http://www.mobilefish.com/services/ssl_certificates/ssl_certificates.php – lubosdz Aug 31 '13 at 20:31

4 Answers4

126

If you're on windows and using apache, maybe via WAMP or the Drupal stack installer, you can additionally download the git for windows package, which includes many useful linux command line tools, one of which is openssl.

The following command creates the self signed certificate and key needed for apache and works fine in windows:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout privatekey.key -out certificate.crt
alexkb
  • 3,216
  • 2
  • 30
  • 30
  • 19
    Thanks for mentioning that OpenSSL comes with git for windows. – Benjamin Albert Feb 23 '16 at 09:47
  • 2
    You can use this method in git bash on Windows too: [How to create an https server?](https://docs.nodejitsu.com/articles/HTTP/servers/how-to-create-a-HTTPS-server/) – Eido95 Jun 16 '17 at 22:54
  • is it SSH-2 or SSH-1? – manish kumar Aug 08 '17 at 09:34
  • 2
    I've got an error: `unable to find 'distinguished_name' in config` `18268:error:0E06D06A:configuration file routines:NCONF_get_string:no conf or environment variable:crypto\conf\conf_lib.c:270:` `privatekey.key` was generated, but not the `crt` file. – tryingHard Nov 06 '19 at 15:04
32

You can download a native OpenSSL for Windows, or you can always use Cygwin.

Adam Batkin
  • 51,711
  • 9
  • 123
  • 115
  • 4
    From that OpenSSL link: "The OpenSSL project does not distribute any code in binary form, and does not officially recommend any specific binary distributions" – Ed Norris Jan 11 '17 at 16:40
  • If you happen to already have scoop installed, you can 'scoop install openssl'. – mpr Aug 03 '20 at 02:27
  • You can also run in Bash for Windows (in Windows 10) – Altair7852 Oct 24 '20 at 03:29
16

To create a self signed certificate on Windows 7 with IIS 6...

  1. Open IIS

  2. Select your server (top level item or your computer's name)

  3. Under the IIS section, open "Server Certificates"

  4. Click "Create Self-Signed Certificate"

  5. Name it "localhost" (or something like that that is not specific)

  6. Click "OK"

You can then bind that certificate to your website...

  1. Right click on your website and choose "Edit bindings..."

  2. Click "Add"

    • Type: https
    • IP address: "All Unassigned"
    • Port: 443
    • SSL certificate: "localhost"

  3. Click "OK"

  4. Click "Close"

teewuane
  • 5,524
  • 5
  • 37
  • 43
  • 1
    The IIS certificate generator doesn't generate valid SSL certificates (see https://stackoverflow.com/questions/46641473/trust-a-self-signed-cert-from-iis) and this doesn't answer the question asked. – Doug Jun 20 '18 at 04:53
  • The question was modified in May of 2014, after my answer. – teewuane Jun 20 '18 at 19:21
8

You can certainly use putty (puttygen.exe) to do that.

Or you can get Cygwin to use the utilities you just described.

Pablo Santa Cruz
  • 176,835
  • 32
  • 241
  • 292
  • 1
    `puttygen.exe` is super simple and i always forget about it! – kodybrown Jun 06 '15 at 21:05
  • 19
    I understand how to create a public/private keypair in puttygen, but how do you create a certificate (.pem) in puttygen? – Aaron_H Jul 14 '16 at 22:13
  • I created public and private key, but what about certificate? – tryingHard Nov 06 '19 at 15:08
  • This question is not about creating (private) SSH-Keys in PEM-format. This is about creating a self-signed X509 SSL-Certificate in PEM-fromat. PuttyGen will not create such certificates. – m4110c Aug 11 '21 at 23:16