Appendix B: Generating SSL Keys with IIS

In order to obtain an SSL Certificate, first you have to generate a private server key and CSR. IIS has a built-in tool that can be used to do this.

  1. Open the IIS Manager from Windows Start > Administrative Tools > IIS Manager.
  2. In the IIS Manager Connections pane, click the server name, and then and double-click the Server Certificates icon in the main pane.
  3. In the Actions pane, choose Create Certificate Request…
  4. Enter the requested information:
    1. Common name must be set to the URL that clients will type into their browsers to access the MassTransit web interface, for example: name.company.com.
    2. Enter your Organization’s name and your organizational unit.
    3. Enter your City/locality. This must be specified as the official name and it cannot be abbreviated.
    4. Enter your State/province. This must be specified as the official name and it cannot be abbreviated.
    5. Select your Country/region.
  5. Click Next.
  6. Select a Cryptographic service provider from the drop down menu.
  7. Select a Bit length from the drop down menu. The bit length should be set to the desired encryption level. 1024 is standard; 2048 is becoming increasingly popular. Click Next.
  8. Specify a file name for the certificate request, and then click Finish. By default, the generated request is stored in C:\Windows\System32\filename.txt.

Next, you must have the certificate request signed by a Certificate Authority such as Verisign or Thawte.

Once you have the signed certificate, you must install it to the server from which the Certificate Request was generated. To do so:

  1. In IIS Manager Connections pane, click the server name, and then double-click the Server Certificates icon in the main pane.
  2. In the Actions pane, choose Complete Certificate Request…
  3. Use the … button to navigate to the signed certificate file.
  4. Enter a Friendly name. The friendly name is not part of the certificate, but helps the server administrators to easily distinguish the certificate. Click OK.
  5. Now you can use this certificate to configure SSL for IIS.