Certificates

Certificates

Certificates can be found with the .mmc certificates snapin

Export option with key to allow import to another computer

Find certificate authority:

• certutil -config - -ping

Update Certificates

Update Certificate on IIS server:

• import certificate to cert store
• open IIS go to default website / whatever site needs cert updating > edit bindings > 443 > select new certificate

In powershell to restart iis to pick up new certificate:

• iisreset -noforce

---

Update cert on ADFS server:

• Import certificate to cert store

Run the following powershell command:

• Set-ADFSsslCertificate -Member <server name> -Thumbprint <New cert thumbprint>
• in ADFS management > service > Certificates > Renew Service Communications certificate with the new certificate

---

Extract .crt

if you need cert in .crt format with key for ssl you can use open ssl to extract the keys.

download from here https://slproweb.com/products/Win32OpenSSL.html

When installing make sure to add to environment variables and PATH to use easily from the command line - go to sysdm.cpl or run the following commands for a one time use:

• set OPENSSL_CONF=C:\Program Files\OpenSSL-Win64\bin\openssl.cfg
• set Path=%Path%;C:\Program Files\OpenSSL-Win64\bin

Use the following command to extract when running openssl as admin:

• openssl pkcs12 -in C:\PathToThePFXfile\myPFXfileName.pfx -out certificate.txt -nodes

This will extract the cert to a text file where you can grab the public and private keys and save them in text as a .crt and .key file.

Extract the key to encrypted key

• openssl pkcs12 -in [yourfile.pfx] -nocerts -out [keyfile-encrypted.key]

Extract unencrypted key

• openssl rsa -in [keyfile-encrypted.key] -out [keyfile-decrypted.key]

Extract Just certificate

• openssl pkcs12 -in [yourfile.pfx] -clcerts -nokeys -out [certificate.crt]

Convert From .pem to pfx

Certificates will need to be converted for use in windows IIS as windows prefers .pfx format

Use the following command

• openssl pkcs12 -export -in <certname>.pem -inkey <privatekey>.pem -out <Certificate>.pfx

SSL Certificates netsh

Check certificates bound to ports in netsh:

• netsh http show sslcert

Add certificate to port:

• netsh http add sslcert ipport:0.0.0.0:443 certhash=<thumbprint of cert without spaces> appid='{EDE3C891-306C-40fe-BAD4-895B236A1CC8}'

Delete sslcert

• netsh http delete sslcert ipport=0.0.0.0:443