Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
What is the difference between openssl and mkcert. Which one should I prefer.
I want to create an IIS hosted WCF service. Which one should I use to create an SSL certificate. Also, there is another option to create an ssl certificate. On the iis we can create a self signed certificate. Can I use this instead of the one created by mkcert or openssl
There is no really well-established command known as "mkcert" (there is apparently one under that name in some IBM systems). Since you are talking about IIS, I suppose that you mean MakeCert.
Certificates follow a standard called "X.509"(*). There are several tools out there who can create certificates. The main virtue of a certificate is to be signed by a Certification Authority because that's what certificates do: they transfer trust in key-name bindings from a "root CA" down to end-entities (e.g. SSL servers). A self-signed certificate does not transfer much; when you use a self-signed certificate, you are actually trying to fit some public key into the outer format of a certificate just so that protocols which require a certificate don't get some apoplexy crisis when they see it.
For your WCF service, you will need the server to own a certificate (and the corresponding private key), and the client will need to trust that certificate. The tool which creates that certificate does not matter much as long as you can instruct IIS to use that certificate-and-key, and you can configure the client to trust the certificate. Since IIS can create the key pair and the certificate in a few clicks, and you necessarily have IIS installed anyway, using IIS inherent abilities at certificate creation is probably the simplest method. You would use MakeCert.exe if you really prefer, for aesthetic reasons, to use a command-line tool; and you would use OpenSSL if you are also allergic to Microsoft tools (but then, why would you use IIS and WCF ?).
The really important point is that you need a certificate because your service will use SSL or some other protection mechanism, and you do that because you fear malicious attacks. Using certificates will help you only if you make sure that the client will trust only the certificate that you generated and installed on the server, so this means that you must take care of where you generate and store the private key, and, preferably, understand what you are doing.
