使用makecert进行开发SSL [英] Using makecert for Development SSL
问题描述
这是我的情况:
我正在尝试创建一个SSL证书,该证书将安装在所有开发人员的计算机上,以及两个内部服务器(一切都是非生产)。
I'm trying to create a SSL certificate that will be installed on all developer's machine's, along with two internal servers (everything is non-production).
创建可以安装在所有这些地方的证书我需要做什么?
What do I need to do to create a certificate that can be installed in all of these places?
现在我已经掌握了这些内容,使用Microsoft Visual Studio中的makecert应用程序8 \ SDK \v2.0 \ BIN:
Right now I've got something along these lines, using the makecert application in Microsoft Visual Studio 8\SDK\v2.0\Bin:
makecert -r -pe -n "CN=MySite.com Dev" -b 01/01/2000 -e 01/01/2033 -eku 1.3.6.1.5.5.7.3.1 -ss Root -sr localMachine -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 mycert.cer
但是,我不确定如何将此.cer文件放在其他计算机上,当我在本地计算机IIS上安装它时,每次我通过https:访问页面时,都会得到安全提示(甚至我安装证书后)。有没有人以前做过这个?
However, I'm not sure as to how to place this .cer file on the other computers, and when I install it on my local machine IIS, everytime I visit a page via https:, I get the security prompt (even after I've installed the certificate). Has anyone done this before?
推荐答案
这是我的脚本:
使用SHA1(-r)创建带有可导出私钥(-pe)的自签名证书(-r),签名(-sky签名)。
私钥写入文件(-sv)。
Create a self-signed certificate (-r), with an exportable private key (-pe), using SHA1 (-r), for signing (-sky signature). The private key is written to a file (-sv).
makecert -r -pe -n "CN=My Root Authority" -ss CA -sr CurrentUser ^
-a sha1 -sky signature -cy authority -sv CA.pvk CA.cer
(^ =允许批量命令行换行)
(^= allow batch command-line to wrap line)
创建一个服务器证书,带有可导出的私钥(-pe),使用SHA1(-a)进行密钥交换(-sky exchange)。
它可以用作SSL服务器证书(-eku 1.3.6.1.5.5.7.3.1)。
颁发证书位于文件(-ic)中,密钥(-iv)也是如此。
使用特定的加密提供程序(-sp,-sy)。
Create a server certificate, with an exportable private key (-pe), using SHA1 (-a) for key exchange (-sky exchange). It can be used as an SSL server certificate (-eku 1.3.6.1.5.5.7.3.1). The issuing certificate is in a file (-ic), as is the key (-iv). Use a particular crypto provider (-sp, -sy).
makecert -pe -n "CN=fqdn.of.server" -a sha1 -sky Exchange ^
-eku 1.3.6.1.5.5.7.3.1 -ic CA.cer -iv CA.pvk ^
-sp "Microsoft RSA SChannel Cryptographic Provider" ^
-sy 12 -sv server.pvk server.cer
pvk2pfx -pvk server.pvk -spc server.cer -pfx server.pfx
然后在服务器应用程序中使用.PFX文件(或在IIS中安装)。请注意,默认情况下, pvk2pfx
不会将密码应用于输出PFX文件。您需要使用 -po
开关。
You then use the .PFX file in your server app (or install it in IIS). Note that, by default, pvk2pfx
doesn't apply a password to the output PFX file. You need to use the -po
switch for that.
要使所有客户端计算机都信任它,请安装 CA.cer 在其证书存储区中(在受信任的根颁发机构存储区中)。如果您在域中,则可以使用Windows组策略在全局范围内执行此操作。如果没有,您可以使用 certmgr.msc MMC管理单元或 certutil 命令行实用程序:
To make all of your client machines trust it, install CA.cer in their certificate stores (in the Trusted Root Authorities store). If you're on a domain, you can use Windows Group Policy to do this globally. If not, you can use the certmgr.msc MMC snapin, or the certutil command-line utility:
certutil -user -addstore Root CA.cer
以编程方式安装IIS 6.0中的证书,请查看此Microsoft知识库文章。对于IIS 7.0,我不知道。
To programmatically install the certificate in IIS 6.0, look at this Microsoft KB article. For IIS 7.0, I don't know.
这篇关于使用makecert进行开发SSL的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!