Upgrading your IIS 1024 SSL Cert to 2048 Encryption

If you’re trying to renew your cert to 2048 on IIS from 1024, it’s not as straight forward.  The cert request you produce on IIS will fail validation at your SSL provider if it’s not a request to renew a 1024 cert.

MS has a solution, but it’s basically.. you create another dummy site. Create a new certificate there and then instead of renewing your other site, you tell it to replace the existing cert with the new one.

Here are the actual steps.

http://support.microsoft.com/kb/295281

1. In the Microsoft Management Console (MMC), right-click the default Web site, click New, and then click Site.
2. Create a new site and give it a temporary name.
3. Right-click the new site, click Properties, click the Directory Security tab, and then click Server certificate.
4. Select Create new certificate and follow the wizard to create a new CSR. When prompted, select Prepare the request now but send it later.
5. Use the CSR that you just created to request a new certificate from the certificate authority (CA) that issued the original certificate.
6. When you receive the certificate from VeriSign or another third-party CA, save it to your hard drive. Remember the serial number of this certificate and where you save it.
7. Right-click the temporary site that you created in step 2, click Properties, click the Directory Security tab, click Server certificate, and then click Next. Follow the wizard. When prompted, select Process the pending request.
8. After the certificate has been installed, click OK, and then stop and start the Web site.
9. Right-click the temporary site that you created in step 2, click Properties, click Directory Security, and then click Server certificate.
10. Select Remove the current certificate and follow the wizard. This removes the certificate from IIS, but the certificate remains in the certificate store.
11. Right-click the Web site that has the original server certificate installed (that is, the certificate that you are renewing or replacing), click Properties, click Directory Security, click Server certificate, and then select Replace the current certificate.
12. Select the certificate that you just installed. If you see duplicate certificate names, make sure that you select the certificate that matches the serial number that you noted in step 6.