I created certificate and installed it on my server. I can using browser to
access the web server using HTTPS. But when I tried to use my app to access
my web server I got following message:
"alert (Level fatal, Description: Bad Certificate"

I guess this is because that my certificate is not trusted by an CA. How can
I fix this without buying the service from an CA? My app is not going to be
used in public. I do not need an CA. Can I create my own CA?

Gary Chen

Hi,



Yes, you can setup your own CA service. Service itself comes with Windows
2000, you just have to configure it. Once you configure it, install CA
certificate on the client. Here is how:



Open Web Interface and go to Download a CA certificate, certificate chain or
CRL. Here click on Download CA certificate. Save the file and transfer it on
the client. Double click on it and follow the wizard. Default values should
be OK. Once you install it, all the certificates issued on this CA will be
trusted.



Here you can find more information about Microsoft PKI (Guides are mostly
for Windows 2003)



New features:
http://www.microsoft.com/technet/prodtechnol/winxppro/plan/pkienh.mspx
Operations guide:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/ws03pkog.mspx
Managing PKI:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/mngpki.mspx
Best Practices:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/ws3pkibp.mspx
Certificate templates -
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/ws03crtm.mspx
Key archival -
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/kyacws03.mspx
Certificate Autoenrollment in Windows Server 2003
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/autoenro.mspx
Advanced certificate enrollment:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/advcert.mspx
web enrollment:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/webenroll.mspx
EFS:
http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/cryptfs.mspx
CRLS: http://www.microsoft.com/technet/security/topics/crypto/tshtcrl.mspx

Mike



[quoted text, click to view]