Using LetsEncrypt with IIS via WinAcme

Finally, the web is really moving to using HTTPS (thank you Google/Chrome!) This change is long overdue, and it will be good to finally be able to eliminate the vulnerability of HTTP.

But“, cry some customers, “I don’t wanna pay for certificates!“.

Bought TLS certificates, well, cost money, and often non-technical customers don’t see any value in them. All they see is cost. If only there were a free alternative.

Good news! LetsEncrypt freely offer free DV certificates for free. That is, in fact, their raison d’être. Bad news – they only last 90 days. Bugger. Our support team won’t dreadfully want to have to renew lots of certs every 90 days. If only this could be automated… Wait, it can be!

One of my colleagues mentioned using WinAcme to get/renew certificates with LetsEncrypt, so I thought I’d give it a go. How hard can it be? Continue reading “Using LetsEncrypt with IIS via WinAcme”

Using LetsEncrypt with IIS via WinAcme

A brief analysis of the NCSC’s “Top 1000 Passwords” list

So, the NCSC has been running a study on the prevalence of the ‘Top 1000 Passwords’. It’s useful stuff, but I wondered – just how frequent are these passwords? How can they know? Where did this list come from?

I noticed, for example, that the list included baseball, which I gather is a degenerate form of rounders. It’s certainly not what I’d expect on a UK-centric list of passwords. Similarly, chicago, and redsox were unlikely. (There are, however, cricket and wanker, so it isn’t an entirely Americanised list).

I also noticed some passwords – like rasdzv3 – that I couldn’t see any obvious reason for being particularly popular.

Anyway – I wondered – how frequent are these? What was the most frequent? Continue reading “A brief analysis of the NCSC’s “Top 1000 Passwords” list”

A brief analysis of the NCSC’s “Top 1000 Passwords” list

Chrome – OTS parsing error: invalid version tag

I saw this weird warning in Chrome’s DevTools while looking at a site:

OTS parsing error: invalid version tag

Uh-huh. That’s a bit strange. Unable to download fonts? What caused that?

Well, I tried going to the font’s URL – and got the ‘Page Not Found’ page! Well, that’s annoying – but a 404 page is clearly not a font.

However, this site’s error pages return HTTP 200 – so Chrome expects a font…

Make sure your error pages return a correct HTTP status code. If you don’t, it can cause problems. Normally, I find that it’s false positives on automated penetration tests, but this is a new and exciting variation.

Chrome – OTS parsing error: invalid version tag

Scott Helme on SSL Certificates…

Scott Helme has posted a number of interesting blog posts recently:

I mean, he’s a bit of a LetsEncrypt fan, but equally, their certificates are as good as others, and EV Certs and SSL Warranties do seem to be sources of revenue generation, rather than offering something useful.

What I’d really like is an easy way to use LetsEncrypt with IIS; for a long time it has seemed like a second-class citizen. Or maybe scripting is just more awkward in Windows. Either way, it’d be great to have simple tooling to support automatically renewing IIS site certs.

Then we could reduced certificate lifetimes and overcome the problems of the broken revocation process in certificates.

Scott Helme on SSL Certificates…

Create a self-signed certificate for development

This is a bit of an aide-memoire, based on

The short form is, you can do this in PowerShell:

  • Open Powershell, running as administrator.
  • Run:

New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -DnsName "example.local" -FriendlyName "example.local" -NotAfter $([datetime]::now.AddYears(5))

  • Go to “Manager Computer Certificate” or run CERTMGR. You should see your certificate

Next, we want to trust this certificate. We’ll need to export it.

  • To export the certificate file you just created as a .PFX file, right click on the certificate, All Tasks -> Export…
  • When the Export menu item is selected, an export wizard is run. On the first window read through the information and click the next button.
  • In the next window, select the radio button “Yes, export the private key” and then click the next button.
  • Select Export Extended Properties, and click next
  • Set a password for the .PFX file you want to create#
  • Choose a path and export the .pfx file

Now import it into the “Trusted Root Certification Authorities” that you can see in Certificate Manager

  • Expand Trusted Root Certification Authorities –> right-click Certificates –> All Tasks –> Import.
  • Select the file you just exported. Note that you may need to change the file type to Personal Information Exchange.
  • Click Next, Fill in your file’s password, and complete the import.

That should be it completed.


An alternative to export the cert:

Copy the Thumbprint of the cert in your Powershell window.

$pwd = ConvertTo-SecureString -String "" -Face -AsPlainText
Export-PfxCertificate -cert cert:\localMachine\my\#Thumbprint# -FilePath #FilePath# -Password $pwd

Create a self-signed certificate for development

VS2017 – Turn off Lightweight Solution Loading

Note to self: I’d a solution where Project A referenced Project B. This had been fine and stable for some time, and then suddenly intellisence started warning that the namespace I needed from B was missing, and that I was missing a project reference. Except I wasn’t. And the solution would build without fault.

I found suggestions of deleting /obj and /.vs folders – which I did – but the fix came from turning off Lightweight Solution Loading. See :

Clear Visual Studio bug.

VS2017 – Turn off Lightweight Solution Loading