Set up a Certificate Server and enable the HTTPS service for IIS

No nonsense text tutorial, teach you to build a CA Server step by step, and enable the HTTPS service for IIS.

1. Set up a Certificate Server (CA Service)

1. In the system control panel, find "Add/delete programs", click "Add/delete Windows Components" on the left side, find "Certificate Service" in the list, and install it.

 

2. There are four options for the CA type. Here we will introduce "independent Root CA.

 

3. Ca identification information. Here you can name your CA server.

 

4. Set the Certificate database to save the relevant databases and log files of the certificate. This is the default setting.

 

5. After the installation is complete, you can open the Certificate Authority in Control Panel-management tools. This tool is used for certificate review.

 

6. After the installation is complete, three related directories will be added to IIS. "certsrv" is the certificate application page.

7. Open the corresponding page and you can see that at this point, the CA server has basically been set up.

 

2. Enable HTTPS (SSL) for IIS

1. Right-click "default website" in IIS and select "properties" to view website properties. Click the "Directory Security" tab and click "server certificate.

 

2. Select "New certificate" and click Next.

 

3. Select "Prepare certificate request now, but send it later" And next

 

4. Enter the organization information. You can decide what to write and the information will be displayed in the certificate.

 

5. Name and security. The default name is the name of the IIS website. The default key length is 1024 bits. Next Step

 

6. Site public name, which is the server's machine name by default. Note that if IIS is an object service, you must enter the corresponding domain name.

 

7. Enter the geographic information as needed. Next Step

 

8. The name of the certificate request file, which is saved on drive C by default. The following encrypted string is displayed after it is opened.

 

9. Copy the encrypted certificate string, go to the certificate application page, and select "apply for a certificate"

 

10. For the certificate application method, select "Advanced Certificate Application"

 

11. Select "use base64 ......"

 

12. Fill in the certificate string in the text box and "Submit". At this point, the certificate application has been completed. (Don't rush to close IE. Click "Homepage" on the right to wait)

 

13. Go back to the Certificate Authority tool and select "pending applications" on the left. You can see an application record in it. The Application ID is the ID you just applied.

Select the record, right-click all tasks, and issue the certificate.

Click "issued certificate" to view the issued certificate.

 

 

14. Return to the certificate application page and select "view the pending certificate application status"

 

15. On this page, you can view all the certificates you have applied for. If there are multiple certificates, there are multiple links.) Click one of them.

 

16. Here, if you have issued a certificate, you can see the certificate download page. Generally, select base64 encoding to download the certificate.

To download the certificate chain, you can also download the Root CA certificate.

 

17. Go back to IIS, the Directory Security page, and click "server certificate". The interface has changed. Select "process pending requests and install Certificates". Next

 

18. Select the certificate you just downloaded and click Next.

 

19. Enter the port used by SSL. Generally, the default value is 443, which does not need to be modified. Now, the certificate application is complete.

 

20. If you want to force HTTPS access to your website, click "edit" on the "Directory Security" tab.

 

21. Select "require secure channel (SSL )"

 

22. Now, refresh the Certificate Application page to see the 403.4 error page, because we have to Use https to access the website.

NOTE: If HTTPS is not required for the entire website, you can also set a virtual directory. The method is the same as above.

 

23. After you change it to HTTPS access, a security alarm will be prompted, indicating that the certificate name does not match the site name, because we have accessed it using localhost.

Do you still remember the public name mentioned above when applying for a certificate? That's it. At that time, we entered the machine name, so it certainly does not match localhost.

This is also the reason why you need to fill in the domain name if IIS is external, otherwise this security alarm will be prompted.

Here you only need to change the address to: https: // dier-vm03/certsrv without prompting for security alerts.

 

24. to scale it out, not every user understands the technology. When a common user sees a 403.4 error, the user does not need to know how to add a second to access it. Is that swollen?

In fact, it is very simple. On the "custom error" tab, find the location of the page file pointed to by 403.4 and open it in. Add a script.

In fact, JavaScript is used to determine whether HTTP is used. If so, it will automatically jump to HTTPS.

[JavaScript]
View plaincopy

1. <SCRIPT type = "text/JavaScript">
2. VaR url = Window. Location. href;
3. If (URL. indexof ("http:")>-1) window. Location. href = URL. Replace ("http:", "https :");
4. </SCRIPT>