IIS Self Signed

 

Securing the server with SSL
Now we want to secure the cats by adding a SSL certificate to our Server.
In your IIS Manager go to your server (The top of the tree to the left) ➜ Scroll down and double-click Server Certificates.

(If your self-signed certificate is already here, jump ahead to the bindings steps)

We need to import our self-signed server certificate in order to enable https communication with SSL, so click Import…

Click the … and find your .pfx file, fill out the password (the -po parameter in your command batch file) and click OK

Your certificate is now added

Double-click the newly added cert to verify that it is trusted (Your self-signed certificates were added to the correct stores in my previous post, so again: read it if you are lost right now ;-))

So far, so good! Now we can add the https binding, the same way as before but choose https with port 443, your domain as the host name and find yourself signed certificate in the drop down list

Check the Server Name Indication box which enables our server to have multiple certificates installed on the same IP address by sending the hostname with the first stage of the SSL handshake. Repeat the same steps to add SSL for www.yourdomain.com but with a certificate where the CN name matches the domain name or a wildcard certificate

Our bindings are complete for now.

Tadaa, you can now use https://yourdomain.com/api/cats and https://www.yourdomain.com/api/cats.

NOTE: Firefox does not use the Windows certificate store, so you will have to add your root CA manually. Go to Firefox Settings ➜ Options ➜ Advanced ➜ View Certificates ➜ Authorities ➜ import your CARoot.cer file

IIS Client Certificate Mapping Authentication
We have now been through the uses of the root and server certificates, and you are probably wondering what to do with the client certificate we also created in my previous post. This is for situations when we for example need to authenticate clients without a user login and password approach but rather want the server to ask the client to show its certificate and if it is the correct one the client is allowed in. This can be done with a Many-To-One or a One-To-One mapping and I will show you how to do both manually in the IIS Manager.