I want to generate a root certificate and SSL certificate (self-signed) for communication between an embedded device and our backend servers (IIS 8.0).
I used OpenSSL to generate a certificate with the following steps:
Here's how I created the root certificate:
openssl genrsa -out ca.key 2048 openssl req -new -key ca.key -out ca.csr openssl x509 -req -days 7305 -in ca.csr -out ca.crt -signkey ca.key
Then I made the SSL certificate like this:
openssl genrsa -out mydomain.com.key 2048 openssl req -new -key mydomain.com.key -out mydomain.com.csr openssl x509 -req -days 7305 -in mydomain.com.csr -CA ./ca.crt -CAkey ./ca.key -CAcreateserial -out mydomain.com.crt
This all worked fine.
After importing in IIS, I get the following supported cipher suites:
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
My embedded device can only handle:
TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA256
I know the limitation is not in our Windows configuration or our IIS, because the sites hosted on that same web server (with our GoDaddy certificate), do support all 4 of these suites.
So I figure I must generate the certificate in another way. I just don't know how ...