Blog Archives

Create Custom and Self Signed SSL Certificate in IIS 6 (Windows Server 2003)

Single domain


Note: Foremost, in order to access your site over HTTPS, the HTTP SSL Service will need to be running. This service binds to port 443 and filters HTTP traffic to IIS.

Relatively easy to do in never versions of IIS , but a few more steps in previous.

First, download SSL Diagnostics from MS:;displaylang=en&id=674

Make sure if you are on 32bit you install the x86 version above or the x64 version if you are on 64 bit.

Once installed, open a cmd prompt.

cd C:\Program Files\IIS Resources\SSLDiag
ssldiag /selfssl /N:CN=( /V:365 /S:(ID)

This will create a self signed cert with ( which is good for 365 days. See link below for additional information on other parameters you may need to pass in such as site identifier and key length (default 1024).

If you try to test it right now, you will likely get a “Page Cannot Be Displayed”, “Cannot Find Server”, “Server Cannot be Found” or something to this effect. This is because the port 443 bindings are not yet in place.

To add the port 443 bindings to your site, run adsutil:

cscript.exe "C:\inetpub\AdminScripts\adsutil.vbs" set w3svc/(site id in iis)/SecureBindings ""

To confirm the certificate was added, navigate to your site in IIS and go to:
(right click domain)->Properties->Directory Security->Secure Communications->View Certificate

Multi domain wildcard


Configuring the wildcard certificate, is essentially the same as above, however simply use * for sub domain in your cert creation and binding, and export and add this cert to your other sub domains which will be using it.

Multi domain SAN or UCC


Subject alternative name certificates a.k.a unified communications certificates can get very expensive when issued by third parties.. To create your own, there are three approaches to consider:

– Certificate Enrollment wizard with an enterprise CA (Using Advanced->Custom Request or New Request->Template)

– Certificate Enrollment wizard with a standalone CA

– Certreq.exe

For more information on configuring your own SAN cert, reference MS Kbase article


On Linux, the process is IMO a bit easier and simply requires openssl. Since this utility is also available for windows, this method can be used on IIS as well.

SAN Cert/Custom Request,
Page Cannot be Display,
Debug SSL Connectivity on Intermediary Device,
Cannot Find Server,
IIS forums,
Server 03 pre SP1 HTTP 1.1 host headers bug with SSL,
Configuring Host Headers (IIS6.0),
Configuring Server Bindings for SSL Host Headers,
Obtaining/Installing Wildcard certificate (IIS6),
SSL Host Headers in IIS 6,
UCC Certificate Partners,
How to Create SAN Certificate for Web Server,
OpenSSL SAN Cert,
How to Request a Certificate With a Custom Subject Alternative Name,


Get every new post delivered to your Inbox.

Join 25 other followers