Home > General Administration > Other Topics > Installing a Self-Signed Certificate on Windows Server

Installing a Self-Signed Certificate on Windows Server

Self-signed certificates can be generated in Windows Server 2008 and 2012 using Internet Information Services (IIS). This is useful in testing environments to quickly generate a certificate that can be used for encrypting communication with external sources, such as Cisco Meraki devices when performing authentication. This guide will walk through how to generate a self-signed certificate using IIS on both platforms.

 


It is important to remember that self-signed certificates are not recommended for production environments. A Certificate Authority (CA) signed certificate is more secure and is considered best practice.

 

Note: Server 2003 can follow similar steps, however is not specifically documented here as it is nearing End-of-Life.

Overview and Use Cases

The Cisco Meraki MX Security Appliance supports Active Directory authentication with Client VPN and Group based content filtering. This feature allows an administrator to configure user authentication against an Active Directory Domain Controller.

When Active Directory authentication is configured, the MX queries the Global Catalog over TCP port 3268. Therefore the Active Directory server (Domain Controller) specified in Dashboard must also hold the Global Catalog role.

The MX requires Transport Layer Security (TLS) when connecting to Active Directory servers for authentication. TLS provides a secure encrypted channel protecting authentication information being passed over the network. A digital certificate must be present in the authentication servers computer certificate store to use TLS. This certificate can be issued by a Certificate Authority (Commercial, Enterprise or Standalone) or be Self-Signed. Please see the following article outlining the specific certificate attributes needed: Certificate Requirements for TLS

Server 2003 Configuration

The SelfSSL utility included in the Microsoft IIS 6 Resource Tool Kit can be used to generate a self-signed certificate in Windows Server 2003. The IIS 6 Resource Kit is available directly from Microsoft

The certificate generated using the SelfSSL utility will work with Active Directory authentication. The command string below can be used to create the the certificate.

selfssl.exe /T /K:1024 /V:365 /N:CN=myhost.mydomain.local /P:3268

  • /T: Adds the created certificate to the Trusted root certificate store on the local server.
  • /K: Specifies the RSA public key encryption to be used. Use 1024 or 2048 bit encryption.
  • /V: Sets the validity period of the certificate in days.
  • /N: Sets the Common Name (CN) value of the certificate. This should be the Fully-Qualified Domain Name or NetBIOS name of the local server.
  • /P: Specifies the port number of the service using the certificate. This should be 389 the LDAP port or 3268 the Global Catalog port.


*If IIS is not running on the machine you may be prompted to overwrite the settings for site 1, answer yes and then you'll be informed that there was an error opening the metabase. The certificate will still be generated.

Server 2008 Configuration

Install IIS

If IIS has already been installed, please continue to the next section.

  1. Open the Server Manager.
    d70a5951-f31f-4596-bb8d-274c5500a23d
     
  2. Right-click on Roles and choose Add Roles.
    6a2adf36-5ddc-4f71-b656-c4e65dd085f2
     
  3. If presented with the Before You Begin page, click Next.
  4. Select the Web Server (IIS) role, and click Next.
    f01176de-8329-4057-b696-766b2c73a880
     
  5. On the next two page, click Next. No selections required.
  6. Confirm the installation by clicking Install.
    2350edf7-178f-435e-845a-a3dd8ace1656
     
  7. When done, click Close.

Generate the certificate

For specifics of how to configure certificate parameters for Meraki integration, please refer to our article on Certificate Requirements for TLS.

  1. In the Server Manager, navigate down to Roles > Web Server (IIS) > Internet Information Services and select the name of the server.
    5d1bb7cc-74e4-4753-ab46-0b12039abac7
     
  2. Under IIS, double-click on Server Certificates.
    622e41d0-58bd-4668-b5e3-384d8f337f1c
     
  3. Under Actions, click Create Self-Signed Certificate.
    7f1ecc9a-2886-4dff-8061-a550bda2a109
     
  4. Enter a name for the certificate, then click OK.
    de20d7c7-4dc4-44e1-b8ee-da117bc7b31e
     
  5. The new certificate should now appear under Server Certificates.
    7698442c-be9e-4197-a455-e673c5cccaef

(Optional) Confirm the certificate exists

If the certificate appeared at the end of the last section, additional confirmation should not be required. However, if desired, perform these steps to ensure the certificate exists in the correct certificate store.

  1. Open a Run prompt and enter 'certmgr.msc'.
    36ae9ca5-dd04-4845-8d24-73d6ec01a288
     
  2. Browse to Trusted Root Certificate Authorities > Certificates.
    68863d2f-3c96-4d75-a7b0-24d0bfcd1f35
     
  3. Confirm that certificate created earlier is listed.

(Optional) Uninstall IIS

Only perform the steps in this section if IIS is not desired on this server. If IIS was already installed prior to beginning this process, it is most likely safe to skip this section.

  1. Open the Server Manager.
    d70a5951-f31f-4596-bb8d-274c5500a23d
     
  2. Righ-click on Roles and choose Remove Roles.
    a5b7d124-2bba-4343-91b7-6f070a401749
     
  3. If presented with the Before You Begin page, click Next.
  4. Unselect the Web Server (IIS) role, and click Next.
    885c097b-03c5-46e2-a02e-ddaeadd0141e
     
  5. Confirm uninstallation by clicking Remove.
    a7ca2561-3371-40f6-a573-3272ebfbbca8
     
  6. When done, click Close.

Server 2012 Configuration

Install IIS

If IIS has already been installed, please continue to the next section.

  1. Open the Server Manager.
    b5994de8-6724-4de5-adb1-bfdfb83f5dca
     
  2. Click Manage then Add Roles and Features.
    f6e36c00-3f37-42d7-95e9-237f48df070b
     
  3. If presented with the Before You Begin page, click Next.
  4. For Installation Type, choose Role-based and click Next.
    4a5b0c9a-b6d5-4629-86d2-abc897589874
     
  5. Select the server to install on, and click Next.
  6. Select the Web Server (IIS) role.
    b4dcc464-6641-4fd7-9d38-a27f99396973
     
  7. Click Add Features when prompted. Then click Next.
    0cf20b28-4a99-4f67-8ce0-21a936ba153c
     
  8. On the next three pages, click Next. No additional selections required.
  9. To confirm installation, click Install.
    cb17c27f-4b31-469f-afbf-f3076ebb354d
     
  10. When done, click Close.

Generate the certificate

For specifics of how to configure certificate parameters for Meraki integration, please refer to our article on Certificate Requirements for TLS.

  1. Open the Server Manager.
    b5994de8-6724-4de5-adb1-bfdfb83f5dca
     
  2. Click Tools and then Internet Information Services (IIS) Manager.
    7aed25f5-9656-4d9c-8765-27ff0b384519
     
  3. Select the name of the server.
    2ccf5cda-88dd-4347-ba96-167c57d7a69e
     
  4. Under the IIS section, double-click on Server Certificates.
    863c3bc0-8a13-4362-81cf-e00c0c437145
     
  5. Under Actions, click Create Self-Signed Certificate.
    8c677686-f1d6-416f-a0a3-08ff462f8e75
     
  6. Enter a friendly name for the certificate.
  7. Select Personal for the certificate store, then click OK.
    5b82e3d9-fed6-4bf3-be0d-fd57d532bef7
     
  8. The certificate should now appear under Server Certificates.
    5ca00c8f-a826-4328-baac-366270ff7ad1

(Optional) Confirm the certificate exists

If the certificate appeared at the end of the last section, additional confirmation should not be required. However, if desired, perform these steps to ensure the certificate exists in the correct certificate store.

  1. Open a Run prompt.
  2. Enter 'certmgr.msc'.
    18e5d398-84f4-4e58-a399-d4de8d95696d
     
  3. Navigate to Trusted Root Certification Authorities > Certificates.
    d47b8726-6456-49a5-ad76-b4303cbcc980
     
  4. Verify that the certificate created earlier is listed.

Uninstall IIS

Only perform the steps in this section if IIS is not desired on this server. If IIS was already installed prior to beginning this process, it is most likely safe to skip this section.

  1. Open the Server Manager.
    b5994de8-6724-4de5-adb1-bfdfb83f5dca
     
  2. Click Manager then Remove Roles and Features.
    64b0fda5-779b-49b8-be43-290bda80e40f
     
  3. If presented with the Before You Begin page, click Next.
  4. Select the server to remove IIS from, then click Next.
  5. Unselect the Web Server (IIS) role, and click Next.
    ce6832a3-bc4e-41c1-a384-d39c2c8d2412
     
  6. On the next page, click Next.
  7. To confirm uninstallation, click Remove.
    2ed46ea6-e779-4959-b2d2-40130a62ffab
     
  8. When done, click Close.
You must to post a comment.
Last modified
16:18, 18 Feb 2016

Tags

Classifications

This page has no classifications.

Explore Meraki

You can find out more about Cisco Meraki on our main site, including information on products, contacting sales and finding a vendor.

Explore Meraki

Contact Support

Most questions can be answered by reviewing our documentation, but if you need more help, Cisco Meraki Support is ready to work with you.

Open a Case

Ask the Community

In the Meraki Community, you can keep track of the latest announcements, find answers provided by fellow Meraki users and ask questions of your own.

Visit the Community