21

I have found this answer, but it doesn't seem to work when trying to create a wildcard certificate.

I have taken the following steps:

  1. Added a certificate to my server with the Powershell command.

New-SelfSignedCertificate -DnsName myhostname01,*.myhostname01 -CertStoreLocation Cert:\LocalMachine\My (I slightly censored the URL to avoid potentially unsafe situations).

  1. Next, I used the SSL certificate in a binding on my IIS server.

  2. I visited the page in Chrome. As expected, the certificate is marked unsafe.

enter image description here

  1. I saved a local copy of the certificate, and manually added a copy of of the certificate to my Chrome trusted CA's. However, the certificate is still not recognized:

    enter image description here

  2. The details of the certificate look like this:

enter image description here

Now, the certificates and URL I am visiting and have set up in my hosts file are all the same. There are no spelling errors. My question: am I using New-SelfSignedCertificate wrong? Or am I doing something wrong somewhere else?

2
  • 1
    Can you use a code block instead of an image for your sample code? It's difficult to read exactly what you are doing.
    – TravisEz13
    Jun 9, 2016 at 19:02
  • I've changed the powershell command per your request, but I can't accurately describe in code or text what windows I'm looking at.
    – yesman
    Jun 10, 2016 at 6:23

2 Answers 2

44

For anyone else who might arrive at this question clinging onto what's left of their sanity, the answer that ended up working for me was this:

New-SelfSignedCertificate -Subject *.my.domain -DnsName my.domain, *.my.domain -CertStoreLocation Cert:\LocalMachine\My -NotAfter (Get-Date).AddYears(10)

4
  • While the project I needed it for has already stopped, I can still use this for my next one. Thanks!
    – yesman
    Jul 6, 2017 at 6:54
  • Do you remember what version and OS you used for PowerShell? I'm having issues with the NotAfter paramter.
    – aaronR
    Oct 27, 2017 at 14:24
  • @aaronR: I think you should have a problem with the Subject parameter as well. As far as I see, the NotAfter parameter (just like the Subject parameter) is supported only by the WS2016 / W10 version of the cmdlet, see: technet.microsoft.com/de-at/library/hh848633(v=wps.640)
    – pholpar
    Dec 5, 2017 at 21:36
  • 1
    Finally!! No hair left on my head but at least it's working at last. Jul 25, 2019 at 3:51
0

A SSL wild card certificate should have one subject with the wildcard and the rest of the DNS names should be in the Subject Alternative Name, which is provided by the DNSName parameter. I believe the example below will do what you want.

Example

New-SelfSignedCertificate -Subject *.myhostname01  -DnsName myhostname01 -CertStoreLocation Cert:\LocalMachine\My 
dir Cert:\LocalMachine\My\ | Where-Object {$_.Subject -eq 'CN=*.myhostname01'} | ForEach-Object {
    [PSCustomObject] @{
        Subject = $_.Subject
        SAN = $_.DnsNameList
    }
}

Result

Subject           SAN
-------           ---
CN=*.myhostname01 {myhostname01}

References

2
  • Thanks! However, I get the error message A parameter cannot be found that matches parameter name 'Subject'. I'm on Windows Server 2012, with IIS8, so this command should work. But it doesn't!
    – yesman
    Jun 13, 2016 at 7:46
  • 1
    I know this CmdLet was changed in WMF 5.0. WMF 5.0 is available for download here
    – TravisEz13
    Jun 13, 2016 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.