Can I create a self-signed SSL certificate for Windows Azure using only makecert.exe?

Question

Background . I need to check the https endpoint for WebRole on Windows Azure. To do this, I need to download a self-signed certificate, add the certificate thumbprint to the WebRole configuration, and finally associate the endpoint with this configured certificate.

I created a self-signed certificate using makecert.exe , which is accessible through the Visual Studio command line. I used the following command:

 makecert.exe -r -pe -n "CN=test.cloudapp.net" -sky exchange -ss my -len 2048 test.pfx 

The command succeeds and I can upload the certificate file to the Windows Azure Guest Service. But WebRole deployment fails with the following error:

Certificate with 6AB fingerprint ... associated with HTTPS input Endpoint2 endpoint does not contain a private key.

I need to export a certificate from my store and choose to enable the private key and provide a password. If I upload this exported certificate file and use its fingerprint, the deployment will succeed.

I want to create a certificate file that includes a private key, without first saving the certificate to any store and exporting it from the store. Is using makecert.exe ?

Answer 1

To create a certificate without saving it in any store, you need to use pvk2pfx.exe (accessible via the Visual Studio command line).

It works as follows:

 makecert.exe -sv CertKey.pvk -n "CN=My Azure Certificate" CertKey.cer pvk2pfx.exe -pvk CertKey.pvk -spc CertKey.cer -pfx MyPFX.pfx -po yourPasswordHere 

Running makecert.exe will give you the password for the private key. You will need to enter this password for the -po argument of the pvk2pfx.exe command.

Finally, you will have a pfx file (containing the private key) named MyPFX.pfx