Geek asks and answers

Certificate marked as not exportable

I am trying to create a development certificate chain for myself for some testing for WCF. I follow the instructions on msdn here: How to create temporary certificates for use during development

Unfortunately, the instructions do not work. The private key is not exported. I even tried it with the "-pe" option for makecert.exe and it still doesn't work. I tried it while working as an administrator and it does not work. In mmc itself, when using "export" on the first screen, where it asks about private keys, the yes / no option is greyed out and the message below it says: "The associated private key is marked as not exportable. Only the certificate can be exported.

Any tips? Perhaps an updated procedure from MSDN, or another one? All I'm looking for is a certificate to use with WCF for basic testing. This is on Windows 8 Pro, although I doubt it.

+5
source share
4 answers

See this SO answer . I used it for a WCF project a few months ago.

Create a certification authority

Create a self-signed certificate (-r) using the exported private key (-pe), using SHA1 (-r) to sign (-sky signature). The private key is written to the file (-sv).

makecert -r -pe -n "CN=My Root Authority" -ss CA -sr CurrentUser ^
         -a sha1 -sky signature -cy authority -sv CA.pvk CA.cer

(^ = enable batch command line)

Create Server Certificate

(-pe), SHA1 (-a) (-sky exchange). SSL (-eku 1.3.6.1.5.5.7.3.1). (-ic), (-iv). (-sp, -sy).

makecert -pe -n "CN=fqdn.of.server" -a sha1 -sky Exchange ^
         -eku 1.3.6.1.5.5.7.3.1 -ic CA.cer -iv CA.pvk ^
         -sp "Microsoft RSA SChannel Cryptographic Provider" ^
         -sy 12 -sv server.pvk server.cer

pvk2pfx -pvk server.pvk -spc server.cer -pfx server.pfx

.PFX ( IIS). , pvk2pfx PFX. -po.

, CA.cer ( ). , Windows, . , snapin MMC certmgr.msc certutil:

certutil -user -addstore Root CA.cer
+3

openssl, , Windows. :

openssl genrsa -des3 -out privkey.pem 2048
openssl req -new -x509 -key privkey.pem -out cacert.pem -days 1095

, - . Win32.

+2

SSL.

IIS :

http://www.softpedia.com/get/Internet/Servers/Server-Tools/SSL-Diagnostics.shtml

And yes, the tool also allows you to do some diagnostic operations.

0
source

More articles:


All Articles