1

From MMC > Certificates I can see there's a certificate for the current machine under 'Trusted Root Certification Authorities > Certficates'. e.g. on my workstation called 'RoryWorkstation1' there's a certificate called 'RoryWorkstation1' listed along with all the normal ones like Baltimore, Microsoft Root Authority, Thawte, Verisign, etc. Can I use this machine certificate to generate an SSL certificate that I can use on the local machine? Clearly it'll only be trusted from the local machine, but for example I'll be able to make requests to https://localhost and the browser will treat that as trusted.

I'd prefer to do this than create a self-signed certificate and add it to the store as that adds it to a machine-wide store of valid certificates, so it's changing the machine state. I'm thinking of doing this in software running as a windows service on the machine and I'd prefer not to change the certificate stores because that seems more intrusive and there's a possibility it could be overridden by Group Policy or similar. Generating a certificate that I can then only use on the machine means I'm not changing the machine state itself. It would mean I end up with a certificate that I can only use within software running on the machine.

In my case the reason I want this is to be able to make https requests to https://localhost without hitting certificate errors. I could use another domain name and use HOSTS file to point at 127.0.0.1 but that could have problems with proxy servers and generally seems less transparent than finding a way to make https://localhost work.

|improve this question
  • 1
    Don't know the answer specifically but why would you do this? If you only want a locally valid certificate, why not just create a self-signed cert. You can do that with the tools provided with MS Office for example. To get IE to accept it, load the cert into the appropriate cert store location. Using Firefox is easier as it has it's own cert store. – Julian Knight Jan 13 '15 at 13:22
4

No, you don't have the private key for that root to sign certificates.

However, as Julian suggested you could generate your own self signed certificate and then add it to your trusted store.

Assuming you're running Windows, this is how you add it to the trusted store: http://blogs.technet.com/b/sbs/archive/2007/04/10/installing-a-self-signed-certificate-as-a-trusted-root-ca-in-windows-vista.aspx

This is how you can generate a self signed cert via IIS7: http://technet.microsoft.com/en-us/library/cc753127(v=ws.10).aspx

This is how you can generate a self signed cert via OpenSSL: https://stackoverflow.com/questions/10175812/how-to-build-a-self-signed-certificate-with-openssl

Have you checked with your IT department to inquire about an internal Certificate Authority? If there is one, you can issue an SSL cert signed by your company's CA.

|improve this answer
  • 1
    does the key exist anywhere, e.g. does windows have access to it? If not what use is that certificate, out of interest? – Rory Jan 13 '15 at 15:17
  • Yes, the key exists on your internal Root Certification Authority server. No, you do not have access to it. (at least you shouldn't) Unfortunately I cannot tell you what your IT department is using that certificate for. As a member of a domain it's common to see a workstation have a certificate for authentication purposes, but that resides in the Personal store, not the Root store. The only reason you would see a non Root certificate in the Root store is to suppress certificate warnings. – k1DBLITZ Jan 13 '15 at 19:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.