How to create a self signed cerficate using command prompt?

5
votes

Is there a way to create a self signed certificate in IIS in windows 2012 R2 using command prompt? I went many documents, everywhere there is tutorial using Windows powershell but not using command prompt. I do not have makecert utility installed in my system. Is there any other command or utility. I saw a selfssl utility but i am not sure whether it will work on windows 2012 RE server.

2
windowsssl-certificate
there are no built-in tools, as Microsoft and other vendors extensively move away from cmd to PowerShell. And why you can't use PowerShell? Any stopping reason? - Crypt32
No specific reason but just want to explore other options. i installed windows sdk which provided me makecert.exe, using which i can create a self signed certificate. But can anyone tell me what are the minimum required parameters to create using makecert and also once its completes and displays suceeded, where can i look for my certificate in my system? - Rahul

2 Answers

3
votes

Try certreq tool. Data are given in a form of inf file. The before mentioned link contains information about the file structure. This link contains example inf file of an SSL certificate (could be of more help).

Then run

certreq -new your_inf_file.inf generated_req.req

As a side effect it will generate a self signed certificate in Certificate Enrollment Requests in the store you specified in the inf file. Just move the certificate to My store and also (because it is self signed) to Trusted Root Certification Authorities.

You can also use xca. It is a nice utility built on openssl which lets you create any certificates (self signed or any chain of CAs) and it is easy to use.

2
votes

I wouldn't bother with makecert as it is deprecated. Instead, I would suggest you use PowerShell as it is the mainstream administration tool in Windows Server. Windows Server 2012 has a built-in cmdlet to generate self-signed certificates: https://technet.microsoft.com/en-us/library/hh848633(v=wps.630).aspx

When Microsoft deprecated makecert tool, they enhanced the certreq cmdline tool with the ability to generate self-signed certificates, though, with an overhead: http://blogs.technet.com/b/askds/archive/2012/08/14/rsa-key-blocking-is-here.aspx