Mismatched Address certificate error - HTTPS localhost IIS

- November 09, 2021

In this post, I describe how to use HTTPS with SSL on a local IIS development environment without the Mismatched Address certificate error:

Screenshot showing mismatched address certificate error

Cause

This error can occur when you use Create Self-Signed Certificate in IIS. The error says "Mismatched Address" and that the server cannot prove that it is its name.

Resolution

To resolve the issue, you can use the PowerShell cmdlet New-SelfSignedCertificate to create the certificates.

The following PowerShell code will create the root certificate, then create the SSL certificate signed by the root certificate, then import the root certificate into the Trusted Root Certification Authorities store:

# Create the root certificate and store the thumbprint in a variable

$thumb = (New-SelfSignedCertificate -Type "Custom" -KeyExportPolicy "Exportable" -Subject "ROOT" -CertStoreLocation "Cert:\LocalMachine\My" -KeySpec "Signature" -KeyUsage "CertSign" -NotAfter(Get-Date).AddDays(10000)).Thumbprint

# Create the SSL certificate using the thumbprint of the root certificate

New-SelfSignedCertificate -type "Custom" -KeyExportPolicy "Exportable" -Subject "CN=localhost" -DnsName "localhost" -CertStoreLocation "Cert:\LocalMachine\My" -KeySpec "KeyExchange" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2") -Signer "Cert:LocalMachine\My\$thumb" -Provider "Microsoft Enhanced RSA and AES Cryptographic Provider" -NotAfter (Get-Date).AddDays(10000)

# You can't create the root certificate directly in the Trusted Root Certification Authorities store, so export it to a file

Export-Certificate -Cert "cert:\localmachine\my\$thumb" -FilePath c:\localhost.cer

# Then import it into the Trusted Root Certification Authorities store

Import-Certificate -CertStoreLocation Cert:\LocalMachine\Root\ -FilePath c:\localhost.cer

Once created, you can then use the SSL certificate in your https binding in IIS:

Screenshot showing an https site binding in IIS with an SSL certificate

Internet Explorer 11 will now open the HTTPS address without an error:

Screenshot of an HTTPS address open in a browser without an error

Note: You will still get a "ERR_CERT_WEAK_SIGNATURE_ALGORITHM" error in Chrome.

EDIT: I've created a follow up post describing how to create a self-signed certificate that does not cause the error NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM

NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM - IIS SSL Certificate

- The hostname in the website’s security certificate differs from the website you are trying to visit.

- How to create a self-signed public certificate - Powershell

Comments

Rockie12 September 2023 at 11:15
Greetings! Your script wrked successfully but unfortunately with no result..
Are there any other steps we need to do? Do You use IE to import this certificate to trusted store?
ReplyDelete
Replies
Rockie12 September 2023 at 12:02
Ok, thank You much Howard for the PS script!

- uploaded Your certificate to "Security"-> "Manage trust" in CA
- used this video (on 7-th minute https://youtu.be/zB4fYkfWcAw?t=423 ) ti add this certificate to Trusted Root Cert. Authorities in Group Policies
- restarted WFE

Now it works for old IE but edge and chrome still give error NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM (Yes You are right)
Don't Tyou have idea how to avoid this warning? In old videos there was no such error but looks like browsers have strengthened security..

Best regards, Gennady
ReplyDelete
Replies