IIS and SSL certs? Pain in the bum?

JamesSykes · 30th November 2007

Firstly I dont like Microsoft nor IIS but alas.......

I have site xyz.com that had an SSL certificate installed. The certificate was going to be renewed but the organisation name had to be changed.

So in IIS you cant actually create a new request if there is already one installed. You can request for renewal but then you cant change any options.

So the work around is to create a new temp site and then create a new CSR request, which is all fine and dandy except when you recieve your SSL certificate from your vendor. According to what i have read you can only install the SSL cert on the IIS site that you requested it from. Well that temp site is gone and i wouldnt want to have to migrate IIS sites over just because IIS is ****ing arse.

So whats the fix? Sure the SSL cert has now expired so i could create a new CSR and wait but why? I have the original CSR and i have the SSL cert, how do i manually force IIS to install? Im sure there must be a way to do this.

Karl · 30th November 2007

We came across this problem with a customer who we regularly do SSL certs for, I don't think they found a way around it other than to generate a new CSR and get the cert re-issued with that CSR.

JamesSykes · 30th November 2007

Did a bit of searching and both Thawte and Verisign and Microsoft give the same answer, you need to re-request the CSR however i stumbled across this :

http://www.entrust.net/knowledge-bas...te.cfm?tn=6926

It worked. I dont know why i have to do some dumb hacking to get this to work, it should work without that kinda shit. Crisis over i'm going home, gonna stop by my favourite off license and pickup 15 cans of stella for a nice round ten pound note

Karl · 30th November 2007

Will have to file that one away in the memory banks for the future.

aguk · 30th November 2007

The easiest thing is to install the cert on the temporary site then export it as a PFX file.

In fact this is how we do all our cert requests. We have 2 SSL temp sites which are purely used for generating CSR and completing the certs. We then pfx them for backup purposes and then install them on the relevant site in IIS.

TDMWeb · 30th November 2007

Yes, PFX is great. You should always create a PFX file, and back it up, when a cert has been installed BTW, as otherwise you're going to have a problem if the machine dies and you need to reinstall stuff.

aguk · 30th November 2007

I have actually been looking at the idea of creating our own certificate generation wizard.

So when someone buys a cert all they do is enter the domain name and password and we generate a PFX file for them on the fly doing the CSR request and receiving the cert in the background.

Mainly becuase the largest number of support requests are now related to deleted pending CSRs or module mismatch errors where they have changed the site while waiting for the cert.

JamesSykes · 3rd December 2007

Yes I have taken heed and saved certs as PFX files for safe keeping. Bloody IIS!

Dhosting · 3rd December 2007

Quote:

Originally Posted by JamesSykes

Yes I have taken heed and saved certs as PFX files for safe keeping. Bloody IIS!

I always save as PFX

All though i will be super happy when helm sort out SSL integration, then I can hook that into the geotrust API, 0 admin time from then on!

PeteK · 8th December 2007

Quote:

Originally Posted by Dhosting

I always save as PFX

All though i will be super happy when helm sort out SSL integration, then I can hook that into the geotrust API, 0 admin time from then on!

According to an email from Mark when trying to get me to renew one of our update subs, SSL is due in this weeks update (i.e. the one just appeared) although I haven't read thru the entire features list yet, it does appear (for a change for H4) that they have:

a. Beta tested it
b. Actually produced more than 3 useless bug fixes to justify the release.

Having said that, it was clear there were a large number of subs due punters as there were many generic emails regarding update protection, probably for those who bought 1/2 years ago (I forget) when they gave lots of cheapo offers on buying H4 about 12 months before it worked so theit customers could be Alpha testers...

Lets hope they continue to actually release updates and its not just a cherry to encourage folks to pay for the update. It might encourage me to upgrade more servers from H3 to H4 too...

Dhosting · 8th December 2007

Have you seen the amount of bug fixes in the latest release, its crazy, we had so many issues before the update its taken like 8 weeks to get everything to a working state.

Lets hope the billing is working correctly.

I didnt see anything about SSL in the update!