Skip to content

Added guide for converting mkcert .pem certificates to IIS .pfx certificates#75

Closed
aweber1 wants to merge 1 commit intoFiloSottile:masterfrom
aweber1:windows-iis-docs
Closed

Added guide for converting mkcert .pem certificates to IIS .pfx certificates#75
aweber1 wants to merge 1 commit intoFiloSottile:masterfrom
aweber1:windows-iis-docs

Conversation

@aweber1
Copy link
Copy Markdown

@aweber1 aweber1 commented Sep 26, 2018

I wasn't sure where to put the guide, so just created a separate file for it with a link from the main readme.

@FiloSottile
Copy link
Copy Markdown
Owner

Thank you for the contribution!

mkcert supports PKCS#12 natively with -pkcs12. Could you verify that the file it creates works with IIS?

I think this guide would make a good blog post with some easily Googleable title, as I can't really maintain it over time in-repo because I don't have easy access to an IIS instance.

@aweber1
Copy link
Copy Markdown
Author

aweber1 commented Sep 26, 2018

oh nice! I didn't see that -pkcs12 option 😄

I can confirm that mkcert -pkcs12 somedomain.net generates a .p12 file that can be renamed to .pfx and imported into IIS using the default changeit password.

Very cool! And totally negates the need for this doc 😉

Do you mind if I change this PR to add the above process for creating IIS pfx to the readme? Also, is there a parameter to set the password via command line? e.g. -password?

@FiloSottile
Copy link
Copy Markdown
Owner

Excellent, thanks!

There is a PR, #58, for PKCS#11 passwords, but I don’t see why it’s useful and I’m allergic to configuration here. What’s the use case?

I still think the best place for the IIS specific instructions is a blog post, as I can’t cover all possible web servers in the docs, but if you really don’t want to go that way, I can enable the wiki in this repo.

@aweber1
Copy link
Copy Markdown
Author

aweber1 commented Sep 26, 2018

Cool. I'm writing a medium post right now 😄

As for the password, probably not terribly useful, it's just required when generating the PKCS cert and when importing it into IIS. As long as it's obvious that changeit is the default and that you shouldn't be sharing the cert I think leaving it as-is is probably ok?

@FiloSottile
Copy link
Copy Markdown
Owner

Cool, I’d be inclined to make it configurable if there was some software that requires a different password, but otherwise I don’t want anyone relying on the terrible encryption that PKCS#11 provides.

Thanks again!

@aweber1
Copy link
Copy Markdown
Author

aweber1 commented Sep 26, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants