Batch Scripting: Makecert.exe

Problem: Special options must be specified with makecert.exe, to create a self-signed certificate that can be used with IIS (Microsoft Internet Information Server).

Note: Microsoft recommends to install and use the "Certificate Server" to generate an SSL test certificate (Q216907), instead of using makecert.exe. But using makecert is simpler.

Solution:

The following command can be used to create and import a self-signed SSL test certificate:

makecert -r -pe -n "CN=www.yourserver.com" -b 01/01/2000 -e 01/01/2036 -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localMachine -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12

To install this certificate in IIS 5.0, open the IIS "Web Site Properties", "Directory Security", "Server Certificate...", "Assign an existing certificate" and select the new certificate from the list.

Note: Older versions of makecert.exe do not support the "-pe" option, which makes the private key exportable. If you have an old version of makecert.exe, you can omit the "-pe" option, but then the certificate cannot be exported including the private key.

(The October 2002 version of the Platform SDK (build 3718.1) contains a new version of makecert.exe (5.131) that supports the "-pe" option. The .NET Framework SDK 1.0 of 2002-03-19 contains an old version of makecert.exe that does not support the "-pe" option).

If the private key is exportable, you can export the certificate together with the private key into a PFX (PKCS #12) file as described in Q232136.

Note: SSL server certificates for IIS are stored in the "Personal" ("My") certificate store of the "computer account" ("localMachine"). The "Certificates" snap-in of the Microsoft Management Console (mmc.exe) must be used to manage these certificates. The normal certificate management window (accessible via "Internet Properties" / "Content" / "Certificates" or via "Control Panel" / "Users and Passwords" / "Advanced" / "Certificates") cannot be used.

Note: To create a key with more than 512 bits, use the "-len" parameter of makecert.exe.

Ref: www.inventec.ch/chdh/notes/14.htm

Ref: msdn.microsoft.com/en-us/library/bfsktky3(VS.80).aspx

Sysadmin: cURL

Found a very powerful commandline tool for transferring data across a multitude of protocols.

"curl is a tool to transfer data from or to a server, using one of the supported protocols (HTTP, HTTPS, FTP, FTPS, SCP, SFTP, TFTP, DICT, TELNET, LDAP or FILE). The command is designed to work without user interaction."

http://curl.haxx.se/

Batch Scripting: Environment Dates

Encountered a funny issue in our staging environment.

Seems like the environment date - %date% is user profile dependant.

If I run echo %date% using my account - I get 16/09/2009

If I run echo %date% using a service account - I get Wed 16/09/2009

Workaround is to strip the dayofweek from the above dates and then split each day, month and year component from the and reassemble each component manually.

For /F "tokens=1-4 delims=/ " %%i in ('date /t') Do (
Set _1=%%i
Set _2=%%j
Set _3=%%k
Set _4=%%l
)
:: Assign to datestamp and split out each date component to associated variable
:: Check for case when date stamp doesn't include day of week
If (%_4%)==() (
Set _datestamp=%_3%%_2%%_1%
Set _year=%_3%
Set _month=%_2%
Set _day=%_1%
) else (
Set _datestamp=%_4%%_3%%_2%
Set _year=%_4%
Set _month=%_3%
Set _day=%_2%
)