hi,

when I configure IIS server on a Windows 2000 or 2003 server to use the ssl
protocol, I have to make a certificate request, during which a Key pair
(public & private) is created.

My public key is sent to the CA alomg with my certificate request which is
then also embedded in My server certificate by the CA.

I want to know where is my private key stored on my local file system. Can I
also see the public key & is it possible to have both this keys copied to a
desired location as a backup.

Vicky

[ Post a follow-up to this message ]

Hi,

IIS certificates that enable you to use SSL are stored under Computer
account and not user account. You can always export the private key by doing
this...

open MMC and click File -> Add/Remove Snap-In -> Add... -> Certificates.
Here click on Computer Account and click Next. Check to see that Local
Computer is selected and click Finish.

Now that you have Certificate MMC open Personal Container -> Certificates.
You will see you IIS certificate. Right click on it and select All tasks ->
Export. In the wizard that starts click on Next -> here you must select
"Yes, export the private key" and click on Next. Follow the wizard by
clicking Next. When prompted enter password (and remember it since you won't
be able to do the import without it) and save the file on hard disk. Make
sure that you have *.pfx file. If you got *.cer file you only have public
key.

I hope this helps.

--
Mike
Microsoft MVP - Windows Security

"Vicky" <Vicky@discussions.microsoft.com> wrote in message
news:6C8FF0A0-B63E-4EE7-ABD0-A497C13F7C7D@microsoft.com...
> hi,
>
> when I configure IIS server on a Windows 2000 or 2003 server to use the
> ssl
> protocol, I have to make a certificate request, during which a Key pair
> (public & private) is created.
>
> My public key is sent to the CA alomg with my certificate request which is
> then also embedded in My server certificate by the CA.
>
> I want to know where is my private key stored on my local file system. Can
> I
> also see the public key & is it possible to have both this keys copied to
> a
> desired location as a backup.
>
> Vicky

[ Post a follow-up to this message ]

Still have doubts
When a web client connects to a ssl enabled web site he receives the web
sites server certificate that consist only the public key.
It means that private keys are not embedded in the website server certificat
e.
On the server itself when you will export the certificate from where will
the private key come?

"Miha Pihler [MVP]" wrote:

> Hi,
>
> IIS certificates that enable you to use SSL are stored under Computer
> account and not user account. You can always export the private key by doi
ng
> this...
>
> open MMC and click File -> Add/Remove Snap-In -> Add... -> Certificates.
> Here click on Computer Account and click Next. Check to see that Local
> Computer is selected and click Finish.
>
> Now that you have Certificate MMC open Personal Container -> Certificates.
> You will see you IIS certificate. Right click on it and select All tasks -
>
> Export. In the wizard that starts click on Next -> here you must select
> "Yes, export the private key" and click on Next. Follow the wizard by
> clicking Next. When prompted enter password (and remember it since you won
't
> be able to do the import without it) and save the file on hard disk. Make
> sure that you have *.pfx file. If you got *.cer file you only have public
> key.
>
> I hope this helps.
>
> --
> Mike
> Microsoft MVP - Windows Security
>
> "Vicky" <Vicky@discussions.microsoft.com> wrote in message
> news:6C8FF0A0-B63E-4EE7-ABD0-A497C13F7C7D@microsoft.com... 
>
>
>

[ Post a follow-up to this message ]

Hi,

You have doubts about what?

Of course the client never receives the private key -- that would be a huge
security hole (think of what would happen if anyone got a private key for
e.g. amazon.com oz ebay.com etc...)... They could decrypt all the
communication between clients and e.g. amazon servers including information
about credit cards...

Here are details about SSL handshake between client and server

Description of the Secure Sockets Layer (SSL) Handshake
http://support.microsoft.com/kb/q257591/

Private keys are in general stored here "RootDirectory\Documents and
Settings\%username%\Application Data\Microsoft\Crypto\RSA", but you can't
just copy them since they are encrypted with random symmetric key called the
master key. To export them you must use the procedure that I described in my
previous post. That file (*.pfx) will include the private key that you can
later import on any other server.

Here is also Microsoft KB article on the subject...

How to back up a server certificate in Internet Information Services 5.0 (It
is same for IIS 6.0).
http://support.microsoft.com/defaul...kb;en-us;232136

Again, I would like to stress that.
- you must select "Local Computer Account" in MMC
- you must select "Yes, export the private key" in the export wizard
- in the end you must have a *.pfx file.

I used these steps on numerous occasions for many of my customers and they
work.

Let me know if you need additional information on this.

--
Mike
Microsoft MVP - Windows Security

"Vicky" <Vicky@discussions.microsoft.com> wrote in message
news:DB7C8440-03C1-4456-A85A-3BD508D95791@microsoft.com...[vbcol=seagreen]
> Still have doubts
> When a web client connects to a ssl enabled web site he receives the web
> sites server certificate that consist only the public key.
> It means that private keys are not embedded in the website server
> certificate.
> On the server itself when you will export the certificate from where will
> the private key come?
>
> "Miha Pihler [MVP]" wrote:
> 

[ Post a follow-up to this message ]