Certificates

Certificates can be found with the .mmc certificates snapin

Export option with key to allow import to another computer

Find certificate authority:

certutil -config - -ping

Update Certificates

Update Certificate on IIS server:

import certificate to cert store
open IIS go to default website / whatever site needs cert updating > edit bindings > 443 > select new certificate

In powershell to restart iis to pick up new certificate:

iisreset -noforce

Update cert on ADFS server:

Import certificate to cert store

Run the following powershell command:

Set-ADFSsslCertificate -Member <server name> -Thumbprint <New cert thumbprint>
in ADFS management > service > Certificates > Renew Service Communications certificate with the new certificate

Extract .crt

if you need cert in .crt format with key for ssl you can use open ssl to extract the keys.

download from here https://slproweb.com/products/Win32OpenSSL.html

When installing make sure to add to environment variables and PATH to use easily from the command line - go to sysdm.cpl or run the following commands for a one time use:

set OPENSSL_CONF=C:\Program Files\OpenSSL-Win64\bin\openssl.cfg
set Path=%Path%;C:\Program Files\OpenSSL-Win64\bin

Use the following command to extract when running openssl as admin:

openssl pkcs12 -in C:\PathToThePFXfile\myPFXfileName.pfx -out certificate.txt -nodes

This will extract the cert to a text file where you can grab the public and private keys and save them in text as a .crt and .key file.

Extract the key to encrypted key

openssl pkcs12 -in [yourfile.pfx] -nocerts -out [keyfile-encrypted.key]

Extract unencrypted key

openssl rsa -in [keyfile-encrypted.key] -out [keyfile-decrypted.key]

Extract Just certificate

openssl pkcs12 -in [yourfile.pfx] -clcerts -nokeys -out [certificate.crt]

Convert From .pem to pfx

Certificates will need to be converted for use in windows IIS as windows prefers .pfx format

Use the following command

openssl pkcs12 -export -in <certname>.pem -inkey <privatekey>.pem -out <Certificate>.pfx

SSL Certificates netsh

Check certificates bound to ports in netsh:

netsh http show sslcert

Add certificate to port:

netsh http add sslcert ipport:0.0.0.0:443 certhash=<thumbprint of cert without spaces> appid='{EDE3C891-306C-40fe-BAD4-895B236A1CC8}'

Delete sslcert

netsh http delete sslcert ipport=0.0.0.0:443

Extract Private key from pfx and create new cert

Extract private key:

openssl pkcs12 -in filetogetkeyextractedfrom.pfx -nocerts -out exportedprivatekey.key

Extract the public key if required:

openssl pkcs12 -in filetogetpublickeyextractedfrom.pfx -clcerts -nokeys -out extractedpublickey.crt

Create new key

openssl pkcs12 -export -out newcerttocreate.pfx -inkey extractedprivatekey.key -in certfilewithpublickey.crt