IIS - Changing to 2048-bit length certificate

Asked By Karen Adams on 09-Feb-10 09:05 AM
Earn up to 50 extra points for answering this tough question.

It is time to renew our SSL certificate on our retail website, and we need to change our SSL certificate from 1024-bit to 2048-bit.  The vendor is requiring the 2048-bit length, now.  We are using IIS 6.  There is no option to create a new certificate (at least while the current one is installed), only to renew.  The renew option won’t let you change the length.  I have seen a few cases listed on the Internet where people have been told to create a temporary site and request the certificate for that site, then after processing the certificate on the temporary site, moving it to the real site. 

 

Could I get some more detail on the steps for doing that.  On the cases I read people seemed to have difficulty getting the certificate moved, and then things “magically worked”.  I don’t want to have to depend on something “magically” working.  Any help you can provide would be greatly appreciated.  Thanks.

Karen 

Rengarajan Govindarajan replied to Karen Adams on 24-Mar-12 04:55 PM
Steps involved :
1.Start -Run -inetmgr
2.Click -Sites-Right Click
3.Create a New Site
a. enter the site name :temp.xxxx 
b.enter the IP address same as original (under website)
c.home directory: same as original
d.port :8080 (under website)
e.DIrectory security -click server Certificate
f.follow the screen to create a new certificate
g.enter name ,
 bit length for encryption (which can be entered as per our requriement)
h.save the cert file in physical location (CSR file)
i.renew the CSR in the website,which will get the o/p as bit length which has entered during the CSR preparation
j.copy the CERT file (after renewal of temp site)and renew the same in temp site with the same DN ,site ,location ,country as original
k.Right click on original  website (for which we have created a temp site to renewal the same)
select Properties - Directory security -server ceritifcate - replace the certificate with the Renewaled one with temp site

Finally we can get the renwaled certicate with new bit length as same as in temp site.
 

Finally