Add SSLDiag to Your IIS Toolbox

SSLDiag provides a single GUI that displays all the relevant IIS SSL configuration information. Most of this information is spread across the IIS metabase and part of it isn't displayed in the Microsoft Management Console (MMC) Internet Services Manager (ISM) snap-in. The tool also displays useful reference information about the selected configuration setting (e.g., the “ServerCacheEntries” setting that Figure 1 shows) in the bottom part of the SSLDiag GUI.

You can also run SSLDiag in silent “log” mode, which means that the tool won't display the SSL configuration information in the SSLDiag GUI but instead dumps it in a log file. The log file is called Ssldiag.log and is created on the local computer in the directory where the SSL Diagnostics executable (Ssldiag.exe) is installed.

SSLDiag checks for the correct configuration of SSL objects and settings and informs the administrator if something is wrong. These objects and settings include SSL client and server certificates, SSL ports, and private keys.

SSLDiag allows IIS administrators to easily test whether their current SSL server certificate is working properly. IIS administrators can temporarily replace their current SSL server certificate with a self-signed certificate from the SSLDiag GUI. Installing a self-signed certificate is as simple as right-clicking a Web site level (e.g., [W3SVC/1] in the example that Figure 1 shows) and selecting “Create New Cert.” When testing is complete, the administrator can restore the original certificate back into IIS.

SSLDiag allows IIS administrators to simulate an SSL connection between their Web server and a browser. This is helpful for determining where in the SSL handshake process the SSL connection breaks down. To simulate an SSL handshake, right-click a Web site level and select “Simulate SSL Handshake” which will bring up the “SSL Diagnostics – Probe SSL” dialog box.

You can also use SSLDiag to monitor the use of SSL client certificates in real time. To do so, you must use SSLDiag’s “client certificate monitor” feature. As SSL client certificate information is being parsed by the Web server, SSLDiag displays both the client certificates that are trying to connect to your Web site and the information contained in those certificates. SSLdiag displays both valid and invalid certificates, including the reasons for invalid certificates (expired, not yet valid, or revoked).