IIS, Self-Signed Certificate, and Chrome

Recently, I needed to set up an IIS server for development. I installed a self-signed certificate on the IIS server, since it is never going to be public facing.

It turned out to be a lot of trouble to get the self-signed certificate to work with Chrome.

First I created a domain certificate from the IIS manager. I exported the certificate and installed it on developer workstations' trusted root certificate store. That seemed to work with Internet Explorer and Edge. But it did not work with Chrome.

I read online that Chrome now requires a "Subject Alternative Name".  The IIS manager generated domain certificate did not have a "Subject Alternative Name". Apparently Microsoft's "makecert" does not generate certificates with "Subject Alternative Name" either. So I used the Power Shell command "New-SelfSignedCertificate" and generated a self-signed certificate with "Subject Alternative Name".

That still did not work with Chrome. Chrome's development tool says everything is okay, but the page is not secure (ERR_SPDY_INADEQUATE_TRANSPORT_SECURITY):

 

These self-contradicting results from Chrome is definitely not helpful to me for solving the problem.

I downloaded IIS Crypto (https://www.nartac.com/Products/IISCrypto/). It suggested a bunch of changes for "Best Practice". I made the changes as suggested, and rebooted the server.

Now Chrome is showing the page without any warnings on the certificate.

This is surprising to me because the server is a new installation of Windows Server 2016. Somehow the out-of-the box settings of IIS on such a server is considered insufficient to Chrome.

Problems When Renewing a Multi-domain SSL Certificate on IIS 7

Last weekend, I needed to renew my multiple domain SSL certificate on my IIS 7 server. The IIS manager just did not work right, and the process was a little complicated. So I would like to share my experience here, hoping that it will help others faced with the same situation.
First of all, how do I know which version of IIS I was running? When you are hosting multiple domains, the default IIS website home page is not likely going to be the IIS start page. So checking the default website home page usually does not work. I opened Windows Task Manager, and selected "Show processes from all users":

  

Then I right clicked on "w3wp.exe", and on its popup menu, I clicked on "Properties":

  

Then I clicked on the "Details" tab:

  

I see that the version number is 7.5…

Now about the SSL certificate installation.

First I installed my new multi-domain certificate by clicking on the "Server Certificates" icon in the IIS Manager Home pane.

The certificate is not applied to any of the websites at this point. I went to the "Bindings…" menu of each website, and edited the https port 443 bindings. I selected the new certificate for each website. I ran into a problem immediately. IIS started to shut down my sites, saying that the port 443 was in use. This is because the "Host name:" field for https binding is always read-only and always blank, even though I had a valid host header value for port 443 before. After the certificate selection, IIS actually changed the host headers to blanks! As a result, all my sites tried to respond to all requests on port 443.

At this point, I had to fix them from the command line. First, I navigated into the "C:\Windows\System32\inetsrv" directory, and then I ran the following command:

appcmd set site /site.name:"IIS Site Name" /-bindings.[protocol='https',bindingInformation='*:443:']

The "IIS Site Name" came from the left pane of the IIS manager. The "-binding" switch removes the binding that does not have a header value specified. Then I ran the following:

appcmd set site /site.name:"IIS Site Name" /+bindings.[protocol='https',bindingInformation='*:443:www.*******.com']

Here www.*******.com is the root of each website URL, in my case each has the form of www.*******.com.

That completed the renewal.