Take the 2-minute tour ×

Consider the need to secure a website under IIS 6 / Windows 2003. Here are the steps taken:

  • Created a private key by OpenSSL:

    openssl genrsa -des3 -out filename.key 2048

  • A CSR was created by OpenSSL with the .key file resulted from above.

    openssl req -new -key filename.key -out filename.csr

  • The CSR was sent to a Certificate Authority. It returned a .pem file.

As I understand, the .pem is the certificate itself. It's unclear to me whether any further processing is needed to match the .key with the .pem. The CA is now in the list of Trusted Root Certificate Authorities in IE7.


  • What steps are needed to convert the .pem into a new file or usable format for use in IIS?

I suspect I'll need a .pfx

alt text

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Yes you'd need to recombine the cert with the private key to form a pfx prior to importing with this tool. Currently the private key is in file format on your system and not in the systems local store.

This commmand is an example

C:\Tools\OpenSSL\bin>openssl pkcs12 -export -in cert.pem -inkey key.pem -certfile cacert.pem -out cert.pfx

where cert.pem is the returned cert, key.pem should be replaced with your filename.key and cacert.pem is the ca certificate. Output is the pfx file that you can use in your wizard, above.

share|improve this answer
Signatures are frowned on. That info belongs in your profile meta.stackoverflow.com/questions/5029/… –  MDMarra Dec 1 '09 at 12:12
Thanks MarkM, Ive asked for Jeff to clarify the example in the above link you supplied is an attempt to advertise job positions and as such is quite a lot different from a simple link to a persons website. If asked i will remove. –  Mark Sutton Dec 1 '09 at 13:51
add comment

Your Answer


