SSL & MS IIS Web Server v5.0

General Notes

Port 80 - HTTP
Port 443 - SSL
- To set, launch Internet Information Services, click on the server, then right click on the "Web Site" of your choice and choose "Properties". Click on the "Directory Secutiry" tab and enter the "SSL Port value".
- If changes, Restart IIS.

IIS v5.0 (XP & Win 2000) - IIS v5.0

Login to the server
- Login with an account that has admin rights.
- Also, you will need to use this same account to perform all of the tasks.
Go to the SSL Screen.
- Launch "Internet Information Services"
- Right click on the web site (ie: Default Web Site)
- Click "Directory Security". SSL is on this page.
Scenario 1: Server Certificate - New - you are request a SSL certificate for the first time.
- Create the request certificate file to send to the Certifying Authority (ie: versign, etc...)
  - Select "Create a new certificate", Next
  - Select "Prepare the request now, but send it later", Next
  - Name and Security Settings
    Name (aka Friendly Name): <hostname>_YYYYMMDD
    Bit Length: 1024 (default is: 512)
    Leave Blank - "Server Gated Cryptograhy SGC certificate (for export versions only)
  - Organizational Information
    Organization: <your info>
    Organizational Unit: <your info>
  - Common name (aka Issued To): <your dns name (ie: hostname)>
    example: michael-thomas.com
  - Geographical Information
    Country/Region:
    State/province:
    City/locality:
  - Certificate Request File Name
    File Name: <hostname>_YYYYMMDD_certreq.txt
    Ex: michael-thomas.com_20070101_certreq.txt
  - Request File Summary, Next
    Verify the info.
  - Click "Finished"
  - Email the file to your Certificate Agency
- Apply the certificate from the Certificate Agency to IIS
  - Take the email from Verisign and create a .cer file with the Certificate info.
    - Filename: c:\<hostname>_YYYYMMDD.cer (use the same info you used with the Request cert file).
    - Copy the certificate info into the file:
      Starting with: -----BEGIN CERTIFICATE-----
      Ending with: -----END CERTIFICATE-----
      Example:
      -----BEGIN CERTIFICATE-----
      ... <the cert info> ...
      -----END CERTIFICATE-----
    - If the email has more than one cert (Primary, Intermediate, Root etc...) create a .cer file for each certificate.
      Example file naming convention: (suggestion)
      <hostname>_YYYYMMDD_step1_intermediate.cer
      <hostname>_YYYYMMDD_step2_root1.cer
      <hostname>_YYYYMMDD_step2_root2.cer
      <hostname>_YYYYMMDD_step2_primary.cer
  - Apply the certificate to IIS
    - Launch "Internet Information Services"
    - Right click on the web site (ie: Default Web Site)
    - Click "Directory Security".
    - Click "Server Certificate", Next
    - Select "Process the pending request and install the certificate
    - If you have more than one .cer file try installing the "step1" first etc...
      Then see if the wizard will let you install all the certs. If not, you'll have to do it manually.
      (In a section below, I'll describe how to import certs manually if you need to.)
    - Path and file name: c:\<hostname>_YYYYMMDD.cer
    - Certificate Summary Screen: Verify the info, then click Next.
    - Finish
  - Your finished, now create a test directory & .html file on the web server, require SSL for that directory and test.
    - In IIS, right click on the new directory, properties, click on the tab "Directory Security". Select "Require secure channel (SSL).
Scenario 2: Server Certificate - Renewal
- If none of the info has changed, then you can renew the certificate.
- Select "Renew the current certificate"
- Select "Prepare the request now, but send it later".
- Example File name: c:\ <hostname/common name>_<yyyymmdd>_certreq.txt
  ex: michael-thomas.com_20070101_certreq.txt
- When you get the cert back from the Certificate Vendor follow the "Apply Cert" steps in Scenario 1.
Scenario 3: Server Certificate - Production work-around for a Change in Information (using same server) - Work around for a Production Server that needs a certificate because one is expiring but also needs to change some of the information (ie: organization, locality etc…) in the cert.
- Create a new Web Site using IIS Manager. I suggest calling it "SSL Temp Web"
  Use the following setting:
  - IP Address: All Unassigned
  - TCP Port: 8099 (Do not use 80! Your production server is currently using that. Just use something you are not currently using. )
  - Suggested Directory: c:\inetpub\wwwroot_sslcerttemp
- Next, follow the steps for "New Certificate" to create the Cert Request and to Apply the .cer file(s).
- Next "Remove" the current certificate from the "SSL Temp Web" site so it is free to be applied to the "Default Web Site".
  - Note: In IIS, click on the temp web site "SSL Temp Web".
  - Go back to the "Directory Security" tab.
  - Click "Server Certificate"
  - Select - Remove the current certificate. Click "Next"
    (Note: This will remove the certificate from the server and store it for later use.).
  - Click Finish.
- Note: Replace the PROD Certificate with the certificate that was applied to the temp web site and then removed.
  - Right click on production web site (ie: Default Web Site),
  - Select - Replace the current certificate.
  - Choose the correct certificate by looking at the "Issued To" , "Issued By" and "Expiration Date".
  - Test with the test SSL URL. If it doesn't work, try "Remove" then "Assign existing Certificate". If that doesn't work try using "localhost" on the server to get to the test SSL URL. I had weird problems and eventually it started working. The test SSL URL was taking forever to load and then showed only the following words on the web page: 1989887952 (0x769b47d0). Not really sure what fixed it other than what I mentioned in this bullet.
    (Note: You may need to normally restart IIS!)
Scenario 4: Server Certificate - Production work-around for a Change in Information (using another server) - Work around for a Production Server that needs a Certificate change (Remove, Create).
- Create a New request certificate on one of your Development servers that have a similar OS. Use the information you would use for the Production server.
- Send the cert to your certificate agency.
- Apply the .cer file to the Development server.
- Under "Directory Security", click "View Certificate"
- Click the "Details" tab.
- Export the certificate as a .pfx file and then apply it to the Production server.
  - Click "Copy to File", Next.
  - Select "Yes, export the private key", Next
  - Select - .PFX - "Personal Information Exchange - PKCS #12 (.PFX)
  - Select "Enable strong protection ..."
    NOT selected: "Include all certificates in the certification path if possible".
    NOT selected: "Delete the private key if the export is successful".
    Next
  - Enter your own password.
  - Example Filename: c:\ <hostname/common name>_<yyyymmdd>_export
    Next
  - Finish
- Copy the file to the Production server.
- On the Production server do the following:
  - WARNING: SSL will be down during this process. Do this off hours.
  - Add the certificate to the Certificate Store
    - Start, Run, mmc
    - Click "Console", "Add/Remove Snap-in", "Add", select "Certificates", click "Add", select "Computer Account", Next, Select "Local computer: (the computer this console is running on), Finish, Close, OK
    - Expand the tree to: Certificates, Personal, Certificates.
    - Right click on "Certificates", All Tasks, Import, Next, the select the file (....PFX) you copied to the production server.
    - Enter the Password.
      Select, "Mark the private key as exportable."
    - Select "Place all certificates in he following store", Next, Finish
    - Close the windows.
  - Assign the certificate to the Web Site.
    - Launch "Internet Information Services"
    - Right click on the web site (ie: Default Web Site)
    - Click "Directory Security".
    - Click "Server Certificate", Next
    - Select "Remove the current certificate", Next
    - Next
    - Finish
    - Click "Server Certificate", Next
    - Select "Assign an existing certificate", Next
    - Select the Certificate from the store list, Next
    - Verify the cert info, Next
    - Finish
Scenario 5: Server Certificate - Remove (Do not use this!)
- Warning: SSL will not work after the certificate is remove !!!
- Select "Remove the current certificate", the follow the prompts.
- Follow the section for "New"

Manually Import Certificates (for SSL's Intermediate & Root)

Add a Certificate Snapin to MMC
- Start, Run, type: mmc.exe
- Console, Add/Remove Snapin.
- Click "Add"
- Click "Certificates"
- Click "Add"
- Select "Computer Account"
- Select "Local Computer"
- Click "Finish"
- Close, Click OK
- Expand "Certificates"
Now, import your certificates using the Certificate Snapin
- Primary Certificate:
  Expand: Certificates/Personal/Certificates
  Right click "All Tasks", "Import" , Browse, File Type ".cer" then choose the file.
- Root Certificates.
  Expand: Certificates//Trusted Root Certificate/Certificates
  Right click "All Tasks", "Import" , Browse, File Type ".cer" then choose the file.
- Intermediate Certificates
  Expand: Certificates/Intermediate Certificate/Certificates
  Right click "All Tasks", "Import" , Browse, File Type ".cer" then choose the file.