I often need X509 certificates – but I never really became friendly with makecert. So I ended up running Windows Cerificate Services which proved to be an easy to use, robust solution. You can have one at home or carry it around in a VM. Perfect.

There are some gotchas you can run into and I refined my configuration over the years. I just had to rebuild my Test CA (on Hyper-V) so I thought I’ll document the important steps (for self-reference and whoever might be interested)

Basic Installation

1. Install Windows Server (2003 or 2008) – either phyiscally or virtually.
2. Install Certificate Services.
3. Select Stand-alone CA.
4. Choose a reasonable lifetime for the CA cert (like 10 years)
5. Backup the CA cert. You need this when rebuilding the machine or having several installations act like the same CA.

Certificate Lifetimes
By default certificates issued with the CA have a lifetime of one year. They usually expire on the very day where you have to do an important demo. You can configure the lifetime in the registry. See here for details.

Revocation Lists
Another common reason why you run into problems with certificates are revocation lists. The location of the revocation list(s) is embedded in certificates in the CDP (CRL Distribution Point) extension. Now by default there is an entry pointing to the CA’s Netbios name. Accessing that network location works while you are in your home network and the CA is up and running. If this network location cannot be accessed, many applications and frameworks will fail certificate validation (the default WCF binding security settings e.g.).

Simply removing the complete CDP extension would be one workaround – but some apps don’t like that at all. So I wouldn’t recommend doing that. A better solution is to create a revocation list once, and store that at a publicly available location. You can also set the lifetime of that revocation list to some high value (like 5 years), so Windows will cache the list. This way you have access to your CRL while on the road and due to the high lifetime value, this will even work when having no network access at all.

To change the CDP settings, open the Certificate Services MMC snap in. Right click on your CA and then select properties. On the extensions tab you can see the list of CRL locations. The first entry specifies the CA local location where CRLs are published. The last three locations get embedded in the certificate. You can delete them and add you publicly available location. Make sure you check the “Include in the CDP extensions of issued certificates” box for your new location.

Next you have to publish a CRL. First you have to set the CRL lifetime. This is configured in the properties of the ‘Revoked Certificates’ folder in the snap in. Set it to e.g. five years. Next you publish via right-Click -> All Tasks -> Publish. You can find the CRL at the previously configured local location.

The last step is to copy the CRL to your public location and that’s it.

Now you can browse to the CA’s web interface (http://server/certsrv) and request certificates. After requesting a certificate you have to go to the CA’s MMC console and issue the cert (in ‘Pending Requests’). Then you can download the certificate by returning to the web interface.

HTH