Generating self-signed certificates can be done for development/testing purposes, but please don’t use self-signed certificates on production systems. Either use an external Certificate Authority (in case your systems are externally accessible), or set up a local CA. If you have a Windows Domain Controller then you can install the Certificate Authority role (AD CS). This way you can generate certificates using a template and the certificates can be signed by the domain controller so that they are automatically trusted on every client machine joined in the domain.

Thanks to Laurens Moutton for providing the following instructions how to create a self-signed certificate with Powershell:

PS C:\Windows\system32> $cert = New-SelfSignedCertificate -certstorelocation cert:\localmachine\my -dnsname 10.90.232.70 [replace IP with DMA IP-address]

PS C:\Windows\system32> $pwd = ConvertTo-SecureString -String ‘selfchosenpassword’ -Force -AsPlainText

PS C:\Windows\system32> $path = ‘cert:\localMachine\my\’ + $cert.thumbprint

PS C:\Windows\system32> Export-PfxCertificate -cert $path -FilePath c:\Temp\certip.pfx -Password $pwd

• Double click on certip.pfx and add it to the trusted root certificate store.
• In IIS Manager
  • Click on server name and then on Server certificates.
  • Click on Import and browse to certip.pfx and add it to the personal store
  • Right click on default website and select bindings. Then for 443 link this to the certificate.

• Note: passwords that are requested is the same used in the command in $pwd

Hi Thomas, in the IIS manager application, you can select your server, and open the “Server Certificates”. In the actions pane on the right-hand side, you will see several options to create certificates: “Create certificate request”, “Create Domain Certificate” and “Create self-signed certificate”.

As already mentioned, a self-signed certificate is mainly intended for test purposes and not recognized by most browsers out-of-the-box. It needs to be installed on each client individually. For production use, it is recommended to use either a domain certificate for systems that are only approached internally, or a certificate issued by an official certificate authority.