Applications Systems

Create self-signed SSL certificates for target IIS servers to support AppInsight for IIS in SAM

This article provides steps and PowerShell scripts that you can use to create self-signed SSL certificates for IIS servers monitored by AppInsight for IIS in SAM. You can create certificates that use either the SHA-256 or SHA-1 algorithm.

First published date

11/29/2018 10:53 PM

Last published date

4/9/2025 8:50 PM

Overview

This article describes how to use a PowerShell script to create self-signed Secure Hash Algorithm (SHA) certificates on target IIS servers monitored by AppInsight for IIS in SAM. You can create certificates that use either the SHA-256 or SHA-1 algorithm.

SAM provides several automated ways to configure target IIS servers for monitoring by AppInsight. These methods (often called "Zero Config") involve using Discovery, the Add Node wizard, or the Configure Server page; see Configure AppInsight for IIS on nodes for details. 

You can also configure target servers manually, which involves running PowerShell scripts and setting up a Windows Remote (WinRM) listener, as described in Advanced manual configuration of AppInsight for IIS. This article provides the PowerShell scripts you'll need to manually create SSL certificates, along with two sets of instructions:

  • One set to create certificates that use the SHA-1 algorithm for SAM 6.6.1 and earlier, and
  • One set to create certificates that use the SHA-256 algorithm for SAM 6.5 or later.

After creating certificates, you'll need to add a Windows Remote Management (WinRM) listener on the target IIS server. Click here for details. 

Note: To learn about PowerShell requirements and security considerations, see Use PowerShell in SAM.

Product section

Server Application Monitor

Resolution

 

To create an SHA-1 certificate for use in SAM 6.4 or earlier:

  1. Log into the target IIS server.
  2. Download this PowerShell script and extract the contents.
  3. In File Explorer, navigate to the folder where you downloaded the script file.
  4. Right-click the file and select Run with PowerShell.
  5. Execute the script with the following parameters:
    • IP address: Mandatory
    • Certificate lifetime in years: Optional

To create an SHA-256 certificate for use in SAM 6.5 or later :

  1. Log into the target IIS server.
  2. Download this PowerShell script and extract the contents.
  3. In File Explorer, navigate to the folder where you downloaded the file.
  4. Right-click the file and select Run with PowerShell.
  5. Execute the script with the following parameters:
    • IP address: Mandatory
    • Certificate lifetime in years: Optional

You can run either script in the PowerShell Console with the default arguments or specify each argument. For example, respond with "127.0.0.1 30" to indicate that 127.0.0.1 is the IP address of the node to be monitored by AppInsight for IIS; "30" refers to 30 years, the lifetime of the certificate.

After creating certificates, create a WinRM listener for the target IIS server, as described here.