IIS, convert an SSL cert to PEM format. As we were moving our SSL termination from the web servers to an F5 3. I needed to convert our SSL certificate to PEM format. This is a subject that has been the source of much frustration and I thought Id clarify the process for individuals suffering the same fate as I using step by step instructions. Update 2. 01. 00. On Windows 2. 00. Certificate Manager Snap In, not the IIS MMC. Requirements. In order to do the conversion, youll need access to your IIS box with an SSL certificate installed and Open. SSL. I run Open. SSL using cygwin http www. Unix tools for NT. Overview. 1. Export the certificate from IIS2. Convert the PKCS1. Verify the certificate. Move the sections in the certificate into the correct order. If your trying to install a 64 bit copy it can only be installed to C drive which must be the lead drive in your bios. After youve loaded your drivers. An update. We replaced the lsi 9650se with a lsi 97508i. And are still experiencing the random datastore disconnects. The last time this happened, we. Broadcom Limited is a diversified global semiconductor leader built on 50 years of innovation, collaboration and engineering excellence. Ware 9650Se Windows 7 Drivers' title='3Ware 9650Se Windows 7 Drivers' />This was a very nasty error that I found in the System Event logs of my Windows 2000 webserver while upgrading a Digital ID for Secure Email certificate. Final test. Detailed Steps. Export the certificate from IIS1. Open the Internet Information Services IIS Manager administration tool. As we were moving our SSL termination from the web servers to an F5 3400 load balancing switch, I needed to convert our SSL certificate to PEM format. Expand the Web Sites node and locate the SSL enabled Web site. Right click this Web site and click Properties. Click the Directory Security tab and in the Secure Communications section of the window, select the View Certificate box. Click the Details tab and click Copy to File. Click Next on the Welcome to the Certificate Export Wizard page. Select Yes, export the private key and click Next Note The private key MUST be exported for SSL to work. If the option to export the private key is unavailable, see Microsoft article 2. IIS Export Private Key Option is Grayed When Exporting a Server Certificate. Ensure that the Personal Information Exchange PKCS 1. ONLY the Include all certificates in the certification path if possible check box. Click Next 9. Enter a password and click Next 1. Enter a file name and location and click Next. Give the file an extension of. PFX 1. 1. Click Finish 1. Move the exported. PFX certificate file to a location from where it may be converted with Open. SSL2. Convert it with openssl openssl. PKCS1. 2. pfx out cert. PKCS1. 2. pfx out cert. Enter Import Password MAC verified OK1. Ensure that the converted certificate is in correct x. Do this by verifying that the following command produces no errors openssl x. Certificate Data Version 3 0x. Serial Number 7. Signature Algorithm sha. With. RSAEncryption. Issuer OVeri. Sign Trust Network, OUVeri. Sign, Inc., OUVeri. Sign International Server CA Class 3, OUwww. CPS Incorp. by Ref. LIABILITY LTD. c9. Ware 9650Se Windows 7 Drivers' title='3Ware 9650Se Windows 7 Drivers' />Customizing your ESXi install with oem. ESXi to customize the installation. With this file you can replace default files that ESXi uses. Veri. Sign. Validity. Not Before Aug 1. GMTNot After Aug 2. GMTSubject CUS, STNew York, LNew York, OTest, OUIT e. Services. Terms of use at www. OUTerms of use at www. CNwww. test. com. Subject Public Key Info Public Key Algorithm rsa. Encryption. RSA Public Key 1. Modulus 1. 02. 4 bit 0. Exponent 6. 55. 37 0x. X5. 09v. 3 extensions X5. Basic Constraints CA FALSEX5. Key Usage Digital Signature, Key Encipherment. X5. 09v. 3 CRL Distribution Points URI http crl. Class. 3International. Server. crl. X5. 09v. Certificate Policies Policy 2. CPS https www. X5. Extended Key Usage Netscape Server Gated Crypto, Microsoft Server Gated Crypto, TLS Web Server Authentication, TLS Web Client Authentication. Authority Information Access OCSP URI http ocsp. Y0. W0. U. imagegif. H. ,. 0. http logo. Signature Algorithm sha. With. RSAEncryption. BEGIN CERTIFICATE MIIEr. TCCBBag. Aw. IBAg. IQd. OD0. BB2v. BEOqi. Sdpq. 3T5. VTANBgkqhki. G9w. 0BAQUFADCBuj. Ef. MB0. GA1. UECh. Mw. Vm. Vya. VNp. Z2. 4g. VHJ1c. 3Qg. Tm. V0d. 29yaz. EXMBUGA1. UECx. MOVm. Vya. VNp. Z2. 4s. IElu. Yy. Ax. Bg. NVBAs. TKl. Zlcml. Ta. Wdu. IElud. GVybm. F0a. W9u. YWwg. U2. Vydm. Vy. IENBIC0g. Q2xhcs. Mg. Mz. FJMEc. GA1. UECx. NAd. 3d. Ln. Zlcmlza. Wdu. Lm. Nvb. S9. DUFMg. SW5jb. 3Jw. Lm. J5. IFJl. Zi. 4g. TEl. BQkl. MSVRZIEx. URC4o. Free Program Air Force Guaranteed Job Program. Yyk. 5Ny. BWZXJp. U2lnbj. Ae. Fw. 0w. NTA4. MTYw. MDAw. MDBa. Fw. 0w. Nz. A4. Mj. Yy. Mz. U5. NTla. MIHl. MQsw. CQYDVQQGEw. JVUz. ETMBEGA1. UECBMKTm. V3. IEplcn. Nle. TEOMAw. GA1. UEBx. QFVW5pb. GDAWBg. NVBAo. UD0. Jl. ZCBCYXRo. IEJle. W9u. ZDEMD0. GA1. UECx. Q2. SVQg. ZVNlcn. Zp. Y2. Vz. VGVyb. XMgb. 2Ygd. XNl. IGF0. IHd. 3dy. 52. ZXJpc. Bh. IChj. KTAw. MTMw. Microsoft Xml Paper Specification Essentials Pack Version 1.0. MQYDVQQLFCp. UZXJtcy. Bv. Zi. B1c. 2Ug. YXQgd. 3d. 3Ln. Zlcmlza. Wdu. Lm. Nvb. S9yc. GEg. KGMp. MDAx. ITAf. Bg. NVBAMUGHd. 3dy. ZWRi. YXRo. YW5k. Ym. V5b. 25k. Lm. Nvb. TCBnz. ANBgkqhki. G9w. 0BAQEFAAOBj. QAwg. Yk. Cg. YEAy. Bfzu. 7Wj. F8. Tegbf. UVZ9. 2VAR3. Gn. XXdi. Q9. 59. H3. 43. MVq. MW1. Xk. Coj. F0. Dq. F5. JHBNCLr. 3VKV4. WSRibo. 4Qy. 2Pm. Oh. C0. UJ6a. At. Rk. Dkzl. En. 04x. Ul. Cmu. 8Mms. 8Fnm. C1s. LBNUdPo. 7Kdjtu2brvwn. Hd. Pt. 1oa. KCj. YYUTo. IQcih. Jk. Dhc. CAw. EAAa. OCAYUwgg. GBMAk. GA1. Ud. Ew. QCMAAw. Cw. YDVR0. PBAQDAg. Wg. MEYGA1. Ud. Hw. QMD0w. O6. A5o. De. GNWh. 0d. HA6. Ly. 9jcmwudm. Vya. XNp. Z2. 4u. Y2. 9t. L0. Ns. YXNz. M0lud. GVybm. F0a. W9u. YWx. TZXJ2. ZXIu. Y3. Js. MEQGA1. Ud. IAQ9. MDsw. OQYLYIZIAYb. RQEHFw. Mw. Kj. Ao. Bggr. Bg. EFBQc. CARYca. HR0c. HM6. Ly. 93d. Vya. XNp. Z2. 4u. Y2. 9t. L3. Jw. YTA0. Bg. NVHSUELTAr. Bglghkg. Bhvh. CBAEGCis. GAQQBgjc. KAw. MGCCs. GAQUFBw. MBBggr. Bg. EFBQc. DAj. A0. Bggr. Bg. EFBQc. BAQQo. MCYw. JAYIKw. YBBQUHMAGGGGh. HA6. Ly. 9v. Y3. Nw. Ln. Zlcmlza. Wdu. Lm. Nvb. TBt. Bggr. Bg. EFBQc. BDARh. MFh. Xa. Bb. MFkw. Vz. BVFglpb. WFn. ZS9na. WYw. ITAfx. Ac. GBSs. OAw. Ia. BBSP5d. Mahqy. Njmv. Dz. 4Bq. 1Eg. YLHs. ZLj. Al. Fi. Nod. HRw. Oi. 8vb. G9nby. ZXJpc. 2lnbi. 5jb. Nsb. 2dv. Lmdp. Zj. ANBgkqhki. G9w. 0BAQUFAAOBg. QCIxz. Yx. JBiwndh. M1. 66lKfi. 18. Hrdkf. Ljf. M0u. Sigophbicx. ZPbsv. D8d. 7RQ2zb. I2ubaef. BLEj. YMCQH8ap. T5. 2XXl. Zn. AEd. ASJRWPH0. U2. Ubepf. Uq. RDj. Uc. Ww. HLb. UI8tm. Hc. Cw. DXJp. Umdq. OQz. En. CKt. SFp. Tpcf. 8n. R5K0. MVf5. A END CERTIFICATE 2. Now that weve verified that the certificate is in correct x. Look at the output example shown below and check for a section that looks similar to this BEGIN RSA PRIVATE KEY Xa. Bb. MFkw. Vz. BVFglpb. WFn. ZS9na. WYw. ITAfx. Ac. GBSs. OAw. Ia. BBSP5d. Mahqy. Njmv. Dz. 4Bq. 1Eg. YLHs. ZLj. Al. Fi. Nod. HRw. Oi. 8vb. G9nby. ZXJpc. 2lnbi. 5jb. Nsb. 2dv. Lmdp. Zj. ANBgkqhki. G9w. 0BAQUFAAOBg. QCIxz. Yx. JBiwndh. M1. 66lKfi. 18. Hrdkf. Ljf. M0u. Sigophbicx. ZPbsv. D8d. 7RQ2zb. I2ubaef. BLEj. YMCQH8ap. T5. 2XXl. Zn. AEd. ASJRWPH0. U2 END RSA PRIVATE KEY For some reason, Open. SSL converts the PFX to PEM where the sections of the certificate are in the wrong order. The key sections shown below must be in the following order a. Private keyb. Intermediate certificatec. Server certificate. As the PEM is a text file, use your favorite editor vi or emacs or any editor that does not add or remove line feeds to reorder the sections as noted above. Key sections within the certificate. The following is the RSA PRIVATE KEY section Bag Attributes. Key. ID 0. 1 0. 0 0. Microsoft CSP Name Microsoft RSA SChannel Cryptographic Providerfriendly. Name 4b. 9cef. 4cc. Key Attributes. X5. Key Usage 1. 0 BEGIN RSA PRIVATE KEY Proc Type 4,ENCRYPTEDDEK Info QWS EDE3 CCC,4. E7. ACA5. F4. 42. ZJ2. Sfs. SVq. Mb. RRf. 6ug. 37. Clua. Y0. Wld. 4fr. PIx. FXy. Jqu. UHr. 31dil. W5ta. 3hb. Ia. QRg. Muge. Rplka. H2. Uwtm. WBk. 4t. 71. Yv. 7Ge. Hmcmjaf. K8. H8i. W8. 0oo. PO3. DENV8. X4. Utlh. 5e. U6ky. WYZ1. BTy. 6thxx. Llw. Aullyn. VXZEfl. NLxq. 1o. XZYl. 6djgj. E3qg END RSA PRIVATE KEY The following is the SERVER CERTIFICATE section Bag Attributeslocal. Key. ID 0. 1 0. 0 0. Name Test CertificatesubjectCAUSTNSWLtestOFurnishingOUSupportCNtest. DCranchDCretailCNhome BEGIN CERTIFICATE MIIFi. TCCBHGg. Aw. IBAg. IKCGry. Dg. AHz. ANBgkqhki.