We're talking about securing web applications in our ITPro class right now, and I thought I should add a little about MakeCert.exe. If you're developing applications that will use SSL encryption, such as an ecommerce system, it's important to configure your development environment (or at the very least your test environment!) with SSL so you can confirm everything functions properly. For example, the checkout portion of your ecommerce app will surely be protected with SSL, so your pages will need to be accessed with HTTPS instead of plain old HTTP. If you don't have an SSL certificate installed on the development server, you're asking for trouble when it comes time to migrate the app. Tracking Session variables and relative page references can be tricky when switching between HTTP and HTTPS!
The solution is so create a test certificate and use it in your development environment. Enter MakeCert.exe. MakeCert is a command line tool that will create a test certificate for you to use in place of a real one. Of course, you could buy a real certificate to test with, but why spend the $$$ if you don't need to. The Certificate companies like VeriSign and Thawte all issue test certificates, but the last time I checked they expired after 90 days or so. Plus, the company adds you to their propaganda email list and may even add you to their phone call solicitation list -- something I try to avoid (as an aside, check out www.mailinator.com for temporary email accounts to fool those email solicitors! Darrell Norton pointed this out to me several months ago.)
MakeCert lets you avoid all the above problems. The only negative with MakeCert is that you get a Security dialog box on every new SSL Session (since the test certificate is not from a trusted Certificate Authority), but you can address this if it bothers you and install the cert on your local machine; personally, in a dev environment, I like having the dialog popup visually notify me when entering SSL mode.
The version of MakeCert that installed with your Visual Studio .Net might be out-dated, but a newer version can be downloaded here: http://download.microsoft.com/download/platformsdk/Update/5.131.3617.0/NT45XP/EN-US/makecert.exe
For details on the command line arguments to create a testing, local Certificate, check out this succinct page: http://www.inventec.ch/chdh/notes/14.htm. If you don't feel like following the link, the command is as follows:
makecert -r -pe -n "CN=www.yourserver.com" -b 01/01/2000 -e 01/01/2036 -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localMachine -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12Update: I should also point out Netscape and Mozilla don't like test certificates with MakeCert!Happy .Netting!