Self-Signed Certificates on IIS 7 – the Easy Way and the Most Effective Way

張貼者 於

Self-Signed Certificates on IIS 7 – the Easy Way and the Most Effective Way | Demystifying The Code

Self-Signed Certificates on IIS 7 – the Easy Way and the Most Effective Way

As per Olav’s blog, run SelfSSL /N:CN=<your web site address (no http://)> /V:<how many days the certificate should be valid> /S:<site ID from above> [/P:<port, if not 443>]
For me it was: SelfSSL /N:CN=www.testssl.com /V:1000 /S:2

How to Create A Self Signed Certificate

張貼者 於

如何製作 SSL X.509 憑證？

How to Create A Self Signed Certificate

How to Create A Self Signed Certificate

How to Create A Self Signed Certificate

How to Create A Self Signed Certificate

 

A self signed certificate is a certificate that is signed by the person creating it rather than a trusted certificate authority. Free self signed certificates can enable the same level of encryption as a $1500 certificate signed by a trusted authority, but there are two major drawbacks: a visitor’s connection could be hijacked allowing an attacker view all the data sent (thus defeating the purpose of encrypting the connection) and the certificate cannot be revoked like a trusted certificate can. We’re going to explain when a self signed certificate should and shouldn’t be used and then share tutorials on how to generate a self signed certificate for common platforms like Microsoft IIS, Apache, and Java Keytool.

When to Use a Self Signed Certificate

Never use a self signed certificate on an e-commerce site or any site that transfers valuable personal information like credit cards, social security numbers, etc.

A certificate serves two essential purposes: distributing the public key and verifying the identity of the server so visitors know they aren’t sending their information to the wrong person. It can only properly verify the identity of the server when it is signed by a trusted third party because any attacker can create a self signed certificate and launch a man-in-the-middle attack. If a user just accepts a self signed certificate, an attacker could eavesdrop on all the traffic or try to set up an imitation server to phish additional information out of the user. Because of this, you will almost never want to use a self signed certificate on a server that requires anonymous visitors to connect to your site. In these cases, you really need to lay down a few bucks on a trusted certificate (there are plenty of cheap SSL certificates). However, self signed certificates have their place:

  • An Intranet. When clients only have to go through a local Intranet to get to the server, there is virtually no chance of a man-in-the-middle attack.
  • A development server. There is no need to spend extra cash buying a trusted certificate when you are just developing or testing an application.
  • Personal sites with few visitors. If you have a small personal site that transfers non-critical information, there is very little incentive for someone to attack the connections.

Just keep in mind that visitors will see a warning in their browsers (like the one below) when connecting to an server that uses a self signed certificate until it is permanently stored in their certificate store.

as3crypto

張貼者 於

as3crypto – Cryptography library for ActionScript 3, including partial TLS 1.0 support – Google Project Hosting

As3 Crypto is a cryptography library written in Actionscript 3 that provides several common algorithms. This version also introduces a TLS engine (TLS is commonly known as SSL.)

  • Protocols: TLS 1.0 support (partial)
  • Certificates: X.509 Certificate parsing and validation, built-in Root CAs.
  • Public Key Encryption: RSA (encrypt/decrypt, sign/verify)
  • Secret Key Encryption: AES, DES, 3DES, BlowFish, XTEA, RC4
  • Confidentiality Modes: ECB, CBC, CFB, CFB8, OFB, CTR
  • Hashing Algorithms: MD2, MD5, SHA-1, SHA-224, SHA-256
  • Paddings available: PKCS#5, PKCS#1 type 1 and 2
  • Other Useful Stuff: HMAC, Random, TLS-PRF, some ASN-1/DER parsing

The library is offered under the BSD license, and include several derivative works from Java, C and javascript sources. Check the LICENSE.txt file for a list of contributors.

You can look at a demo of the functionality of the library. It’s built with Flex 2. It includes a unit test tab, and a benchmark tab.

This is what the benchmark tab outputs on my computer (Athlon64 2Ghz):