View source for HowTo:Create UBIK Web Service Certificates

To make the webservice accessible from a client, the client has to establish a secure connection to the webservice. Therefore, a certificate has to be provided and installed to the IIS server running UBIK. If there is not real Root Authority Certificate, a temporary developer certificate can be used for development and testing:

== Prerequisites ==
For the creation of development certificates either a visual studio development environment or a .NET framework SDK containing the certification tools is needed. For example, one of these packes can be installed:
* Microsoft Windows SDK for Windows 7 and .NET Framework 4; To save time and bandwidth selecting ".Net Development Tools" is sufficient for certification needs.<br/>http://www.microsoft.com/en-us/download/details.aspx?id=8279<br/>[[File:WebserviceCertification_NetSDKINstallation.png‎|220 px|border|alt=Install Windows SDK]]<br/>
* Microsoft Visual Studio Express 2013 für Windows Desktop.<br/>http://www.microsoft.com/de-at/download/details.aspx?id=40787

The binaries for “makecert” and "pvk2pfx" can be found here (can vary depending on the used packages):
* C:\Program Files (x86)\Microsoft SDKs\Windows\v7.1A\Bin
* C:\Program Files\Windows Kits\7.1\bin
* C:\Program Files (x86)\Windows Kits\8.1\bin\x64 or .\x86

To use the tools you basically need a windows command console window with admin-rights and the path varible set to the directory contaning the certification binaries. If a visual studio development environment is installed, you alternatively can start a "Visual Studio Development Console" out of the start menu.

== Root Authority Certificate ==

This step can be ignored if there is already a valid root authority certificate installed on the server and the client! If not, you can create a self-signed root authority certificate and install it on the server and the client as a trusted root authority certificate.

<code>makecert -n "CN=<ROOTNAME>" -r -sv <ROOTNAME>.pvk <ROOTNAME>.cer</code><br/>
ROOTNAME ... self-signed root authority name<br/>
see [http://msdn.microsoft.com/en-us/library/bfsktky3%28VS.110%29.aspx MSDN]

Example:<br/>
<code>makecert -n "CN=Augmensys" -r -sv AugmensysCA.pvk AugmensysCA.cer</code>

== Create Service Certificate ==

To create a specific service certificate, we define the site name (IP) of our sevice along with the service name.

<code>makecert -sky <SITENAME> -iv <ROOTNAME>.pvk -n "CN=<SITE-IP>" -sv "<SITENAME>.pvk" -ic <ROOTNAME>.cer <SITENAME>.cer -sr currentuser -ss My</code><br/>
SITENAME ... Name of the service
SITE-IP ... IP of the service (which should be accessed from the client)
See [http://msdn.microsoft.com/en-us/library/bfsktky3%28VS.110%29.aspx MSDN] for details.

Example:<br/>
<code>makecert -sky AugDemoIIS01 -iv AugmensysCA.pvk -n "CN=137.135.200.180" -sv "AugDemoIIS01.pvk" -ic AugmensysCA.cer AugDemoIIS01.cer -sr curren-tuser -ss My</code><br/>

While creating the certificate, the user is asked for a password to be entered, please remember this password as it it is used for further steps.

== Convert Service Certificate for Import in IIS ==

The created certificate has to be converted for importing it on an IIS service.

<code>pvk2pfx -pvk "<SITENAME>.pvk" -spc "<SITENAME>.cer" -pfx "<SITENAME>.pfx" -pi <PASSWORD></code><br/>
See [http://msdn.microsoft.com/en-us/library/windows/hardware/ff550672%28v=vs.85%29.aspx MSDN] for details.

Example:<br/>
<code>pvk2pfx -pvk "AugDemoIIS01.pvk" -spc "AugDemoIIS01.cer" -pfx "AugDemoIIS01.pfx" -pi mysecretpassword</code><br/>

Now the certificate is ready to be imported on the IIS.

== Configure IIS ==

How to configure the IIS using the created certificate(s) can be done as described in section [UBIK Web Service].

== See also ==
* [[Install UBIK Web Service]]
* [http://www.digitallycreated.net/Blog/38/using-makecert-to-create-certificates-for-development external How-To]

[[Category:How-To]]