From MMC > Certificates I can see there's a certificate for the current machine under 'Trusted Root Certification Authorities > Certficates'. e.g. on my workstation called 'RoryWorkstation1' there's a certificate called 'RoryWorkstation1' listed along with all the normal ones like Baltimore, Microsoft Root Authority, Thawte, Verisign, etc. Can I use this machine certificate to generate an SSL certificate that I can use on the local machine? Clearly it'll only be trusted from the local machine, but for example I'll be able to make requests to https://localhost
and the browser will treat that as trusted.
I'd prefer to do this than create a self-signed certificate and add it to the store as that adds it to a machine-wide store of valid certificates, so it's changing the machine state. I'm thinking of doing this in software running as a windows service on the machine and I'd prefer not to change the certificate stores because that seems more intrusive and there's a possibility it could be overridden by Group Policy or similar. Generating a certificate that I can then only use on the machine means I'm not changing the machine state itself. It would mean I end up with a certificate that I can only use within software running on the machine.
In my case the reason I want this is to be able to make https requests to https://localhost
without hitting certificate errors. I could use another domain name and use HOSTS file to point at 127.0.0.1 but that could have problems with proxy servers and generally seems less transparent than finding a way to make https://localhost
work.