Creating self-signed certificate using makecert.exe

I've had to create self-signed certificates on quite a few occasions over the years.
There are multiple scenarios when one might want to create these self-signed certificates. Two of the most popular tools used for certificate generation are...

OpenSSL (on windows and Linux)
makecert (on windows)

I'll cover the usage of makecert.exe in this post.

Where to get makecert.exe

Windows SDK
If you have Windows SDK installed, based on the version that you have installed you can find makecert.exe at one of the following locations...

Version	Location
7	C:\Program Files (x86)\Microsoft SDKs\Windows\v7.1A\bin
8	C:\Program Files (x86)\Windows Kits\8.0\bin
8.1	C:\Program Files (x86)\Windows Kits\8.1\bin
10	C:\Program Files (x86)\Windows Kits\10.0\bin

Visual Studio (if Visual Studio IDE is installed)
In case you are already using Visual studio you will find makecert.exe at one of the following locations...

Version	Location
2015	C:\Program Files (x86)\Windows Kits\10.0\bin
2013	C:\Program Files (x86)\Windows Kits\8.1\bin
2010	C:\Program Files\Microsoft SDKs\Windows\v7.0A\bin
2008	C:\Program Files\Microsoft SDKs\Windows\v6.0A\bin

Usually, certificates are generated for enabling HTTPS on the web server. The other reason is client authentication.
I'll cover both of these cases
1. server certificates
2. client certificates

We'll also create Root CA certificates for signing both of these certificates.

Say, suppose I have a company named FunSoft that is working on a new cloud service offering called FunSoft Cloud Service.

Root CA certificate:

makecert.exe -r 
             -n "CN=FunSoft Root Authority,O=FunSoft,OU=Development,L=Pune,S=MH,C=IN" 
             -pe 
             -ss Root 
             -sr LocalMachine 
             -sky signature 
             -m 120 
             -a sha256 
             -len 2048

Switch	Usage
r	Mark the certificate as self-signed.
n	Certificate subject name; starts with “CN=”. An example value is “CN=Test Certificate”.
pe	Switch to mark the generated private key as exportable.
ss	Certificate store name. Most common options are [AuthRoot/CA/My/Root]
sr	Certificate store location. Valid options are [CurrentUser/LocalMachine]. Default to ‘CurrentUser’
sky	Subject key type. Valid options are [signature/exchange/[integer]].
m	Number of months for the certificate validity period.
a	Signature algorithm. Valid options are [md5/sha1/sha256/sha384/sha512]. Default to ‘sha1’.
len	Generated Key Length (Bits). An example value is 2048.

Note:

Abbreviation	Full form	Example
C	Country	IN -> India
S	State	MH-> Maharashtra
L	Locality	Pune
O	Organization	FunSoft
OU	OrganizationalUnit	Development
CN	Common Name	FunSoft Root Authority

You will also find this in the certificates snap-in at
Certificates(Local Computer) \=> Trusted Root Certification Authorities \=> Certificates

Server certificate signed with Root CA

We will now create a server certificate signed with the Root CA certificate created above...

makecert -pe 
         -n "CN=*.funsoft.com" 
         -a sha256 
         -len 2048 
         -sky exchange 
         -eku 1.3.6.1.5.5.7.3.1 
         -sp "Microsoft RSA SChannel Cryptographic Provider" 
         -sy 12 
         -in "FunSoft Root Authority" 
         -is Root 
         -ir LocalMachine 
         -ss My 
         -sr LocalMachine 
         -m 13
         funSoftServerCert.cer

Switch	Usage
pe	Switch to mark the generated private key as exportable.
n	Certificate subject name; starts with “CN=”. An example value is “CN=Test Certificate”.
a	Signature algorithm. Valid options are [md5/sha1/sha256/sha384/sha512]. Default to ‘sha1’.
len	Generated Key Length (Bits). An example value is 2048.
sky	Subject key type. Valid options are [signature/exchange/[integer]].
eku	Comma-separated Enhanced Key Usage based on Microsoft’s Object IDs (OIDs)
sp	Subject’s CryptoAPI provider’s name
sy	Subject’s CryptoAPI provider’s type
in	Issuers certificate common name
is	Issuers certificate store name
ir	Issuers certificate store location
ss	Certificate store name. Most common options are [AuthRoot/CA/My/Root]
sr	Certificate store location. Valid options are [CurrentUser/LocalMachine]. Default to ‘CurrentUser’
m	Number of months for the certificate validity period.

Note:

EKU	OID	Use
serverAuth	1.3.6.1.5.5.7.3.1	SSL/TLS Web Server Authentication
clientAuth	1.3.6.1.5.5.7.3.2	SSL/TLS Web Client Authentication
codeSigning	1.3.6.1.5.5.7.3.3	Code signing
emailProtection	1.3.6.1.5.5.7.3.4	E-mail Protection (S/MIME)

Client certificate signed with Root CA

We can also create a client certificate for client authentication as follows...

makecert -pe 
         -n "CN=SUN" 
         -a sha256 
         -len 2048 
         -sky exchange 
         -eku 1.3.6.1.5.5.7.3.2 
         -sp "Microsoft RSA SChannel Cryptographic Provider" 
         -sy 12 
         -in "FunSoft Root Authority" 
         -is Root 
         -ir LocalMachine 
         -ss My 
         -sr LocalMachine 
         -m 13
         funSoftClientCert.cer

Observe that the only value we have changed here is eku and CN.

Now, one thing to note here is that you could issue client certificates with CN value scoped at

per machine or
The CN value can be the machine name (you could also have the machine FQDN if your machine is part of a domain).
per user
In this case, you could have the user name in CN and set the -sr switch to CurrentUser.