How to create a SSL certificate for your local IIS website using PowerShell

In order to develop apps using the HTTPS URL on your local machine, you should create SSL certificates. 

SSL works by ensuring that any data transferred between users and websites or between two systems remains harder(if not impossible) to read as the data might potentially include some sensitive information, i.e. names, payment details etc. Please read this article for more details. 

Creating a development SSL certificate will stop you from seeing the following error when you visit your local IIS website and potentially save you some headaches in the near future as things get more strict with security.

There are multiple ways to generate a SSL certificate. I prefer to use Windows PowerShell to generate my local certificates and here is how you can do it;

• Open up PowerShell and run it as an Administrator
• Type the following command for your project and hit enter.

New-SelfSignedCertificate -DnsName "YOURPROJECTNAME.localhost" -CertStoreLocation "cert:\LocalMachine\My"

• This will generate an SSL certificate for you. You can check it by going to your IIS / Server Certificates

• The next step is to open up "Manage computer certificates" to start using your new certificate in your app.

• Find your new certificate in Personal/Certificates and copy it.

• Go to Trusted Root Certification Authorities/Certificates and paste your new certificate here.

• Now you are ready to use your new SSL certificate for you local IIS app. Go to IIS Manager and add a new website or go to your existing website - make sure your project name is same as your certificate name.

• Go to bindings, add your HTTPS binding using 443 port number and select your new SSL certificate, check "Require Server Name Indication" and save your changes. 

• Finally, visit your local website and make sure all is good. 

Additional note 10.02.2022:

Today I have learnt from my colleague David B that this approach might create some issues if you are using an old version of Identity Server. 

You can see the problem and solution below - thanks David for your contribution and thanks to my other colleague Lukasz W for helping David to identify and fix the problem. 

Problem: 

Apparently, when you create your certificates using the New-SelfSignedCertificate command that I have shared above, some older versions of Identity Server can not read keys generated in CNG(Crypto-Next Gen) format as they require the older CAPI style certs. 

Solution:

In order to support the older CAPI style while generating your certificates, you should add the  -KeySpec KeyExchange to the end of your New-SelfSignedCertificate command call. 

Before:

New-SelfSignedCertificate -DnsName "YOURPROJECTNAME.localhost" -CertStoreLocation "cert:\LocalMachine\My"

After:

New-SelfSignedCertificate -DnsName "YOURPROJECTNAME.localhost" -CertStoreLocation "cert:\LocalMachine\My" -KeySpec KeyExchange