Setting up LetsEnccrypt on IIS 6.x Windows Server 2003

Help
21

I must be blind, I don't remember that 'www prefixed' dialog!! I use NoScript in Firefox, maybe that dialog was blocked?

I'll regenerate the cert, but ... my organization name would be www.computerdatabase.com and my common name would be computerdatabase.com, right?

22

close

ZeroSSL is a good client and will create a SAN (multi domain certificate) for you. You should cover both of these as it looks like your server is listening for both www.computerdatabase.com and computerdatabase.com domains :smiley:

The names that will be covered

computerdatabase.com
www.computerdatabase.com

Once you obtain and install the new certificate (covering www.computerdatabase.com and computerdatabase.com ) you should be all good

Andrei

23

These are both terms from X.509 jargon, but Let's Encrypt in particular ignores organization name because of the theory that we cannot really confirm automatically what "organization" operates a particular site. So, the subject ON field is left out of all Let's Encrypt certificates. By an old convention, the CN field is used to list a DNS domain name for a site, but modern certificate-issuing practice also uses subject alternative names (the SANs that @ahaw021 mentions), of which there can be more than one, to list all of the domain names.

24

Andrei - I just tried again, but never saw that dialog about including www.prefixed version too?

I'm using a csr generated by IIS6.

I just paste it into the 'paste your CSR' box, that dialog never pops up between when I verify the key presented to me.

I'm perplexed, are you using other steps? Possibly you're not using an IIS6 generated CSR, and it's acting differently?

I'm using Firefox with NoScript, but I've given zerossl,com and letsencrypt.org permissions. When does the popup appear?

25

hi @sslWannabe

Apologies - should have explained it a bit more

If you paste your own CSR then the www-prefix will not show up

If you just paste the domain name it will (ZeroSSL will then generate the CSR etc for you)

I had a look and there is no apparent way for SAN CSRs from IIS 6.x

The workaround would be to create a CSR for www.computerdatabase.com (so you will manage two individual certificates) and create bindings for each version (i.e. www.computerdatabase.com and computerdatabase.com) each with itā€™s own certificate

Andrei

26

Andrei - Iā€™m behind ISA Server - each SSL has to have itā€™s own listener, itā€™s own ip address, so from what youā€™re saying (two certificates would be necessary), Iā€™d have to use two ip addresses for each domain?

I thought Iā€™d try the REE SSL Certificate Wizard to start and debug the process and then move on to the other techniques, but ā€¦ would the technique the author of that site suggested here work on IIS6?

https://www.linkedin.com/pulse/lets-encrypt-part-1-issuing-installing-certificates-andrei-hawke

thanks!!

27

Or - should I just create the CSR totally within the FREE SSL Certificate Wizard? And then import that into IIS? Iā€™m about out of my league with SSL I guess?

28

create a certificate using the ZeroSSL client

Convert to PFX and import to Cert Store and Assign to IIS and ISA

I am not sure how well they will do with a SHA256 SAN Certificate so the best thing to do is try

Andrei

29

The tech note

worked perfectly for www and no www.

Thanks for your patience!

My next step is to try the Crypt-LE tools Releases Ā· do-know/Crypt-LE Ā· GitHub to automate things a bit more.

30

i am also running that client through itā€™s paces

my findings thus far: New Windows client - ZeroSSL as Win32/Win64 binaries

31

Your testing results look very promising!

All thatā€™s left is a way to automate adding the keys to the certificate stores on Windows, probably with PowerShell - and deleting any older expired certificates?

32

I have updated the documentation for ZeroSSL downloadable client to outline how you might automate renewal on Windows - https://zerossl.com/usage.html

Hopefully it might be helpful.

1 Like
33

Is it possible to create a wildcard cert using the ZeroSSL downloadable client? I often have a prefix when Iā€™m testing other than www or nothing.

I read the doc where you referenced for ECC certs. Iā€™d heard about Elliptic Curve Cryptography on the Security Now podcast.

If Iā€™m reading it properly, even the latest Firefox on an XP machine wouldnā€™t be able to read it - or ā€¦ will it? I actually have some clients running XP.

34

Since ZeroSSL uses Letā€™s Encrypt API and Letā€™s Encrypt does not provide wildcard certificates (at least for now), the answer to the first question is no.

As for the ECC compatibility, recent versions of Firefox on XP do not seem to have any problems with that at all. Additionally, if you are using NginX for example as your web-server, you can easily specify both ECC and RSA versions - see https://scotthelme.co.uk/hybrid-rsa-and-ecdsa-certificates-with-nginx/ for details.

35

Which version of Perl and download location do you recommend for Windows?

36

If you want the client specifically in Perl (for example to develop additional modules), then Strawberry Perl portable edition would be the best choice. Installation instructions can be found at https://zerossl.com/installation.html

However, if you just want a Windows client and do not plan to do any Perl development, then you might consider using Windows binaries instead - they are also fully portable and do not require any installation.

37

My preference is the windows binaries alone - I looked at the readme.md and it seem to imply Iā€™d need Perl ā€œWith Windows you donā€™t have to install anything but Perlā€, which confused me. Thanks!!

38

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.