如何通过编程方式将本地网站证书设为IIS Express开发证书？

使用PowerShell脚本实现 #

以下脚本可自动定位IIS Express配置文件，找到本地IIS Express开发证书，并绑定到指定HTTPS端口：

# 定义目标HTTPS端口
$targetPort = "44300"

# 获取IIS Express开发证书
$cert = Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object {
    $_.Subject -match "CN=localhost" -and $_.FriendlyName -eq "IIS Express Development Certificate"
}

if (-not $cert) {
    Write-Error "未找到IIS Express开发证书，请先运行IIS Express生成证书"
    exit 1
}

# 定位IIS Express配置文件路径
$configPath = Join-Path -Path $env:USERPROFILE -ChildPath "Documents\IISExpress\config\applicationhost.config"

if (-not (Test-Path $configPath)) {
    Write-Error "未找到IIS Express配置文件，请确认IIS Express已安装并初始化"
    exit 1
}

# 修改证书绑定配置
$xml = [xml](Get-Content $configPath)
$binding = $xml.configuration."system.applicationHost".sites.site.bindings.binding | Where-Object {
    $_.protocol -eq "https" -and $_.bindingInformation -like "*:$targetPort:*"
}

if ($binding) {
    $binding.Attributes["certificateHash"].Value = $cert.Thumbprint
    $binding.Attributes["certificateStoreName"].Value = "My"
    $xml.Save($configPath)
    Write-Host "已成功将IIS Express开发证书绑定到端口 $targetPort"
} else {
    Write-Error "未找到端口 $targetPort 的HTTPS绑定，请先在IIS Express中添加该端口的HTTPS站点"
}

若需自动生成证书，可在脚本中加入以下片段：

# 生成新的IIS Express开发证书（如果不存在）
if (-not $cert) {
    & "${env:ProgramFiles(x86)}\IIS Express\IisExpressAdminCmd.exe" setupSslUrl -url:"https://localhost:$targetPort/" -UseSelfSigned
    # 重新获取证书
    $cert = Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object {
        $_.Subject -match "CN=localhost" -and $_.FriendlyName -eq "IIS Express Development Certificate"
    }
}

使用C#/.NET程序实现 #

以下控制台应用可完成证书绑定操作，需引用System.Security.Cryptography.X509Certificates和System.Xml.Linq：

using System;
using System.IO;
using System.Security.Cryptography.X509Certificates;
using System.Xml.Linq;

class Program
{
    static void Main(string[] args)
    {
        string targetPort = "44300";
        string configPath = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.MyDocuments), 
            "IISExpress", "config", "applicationhost.config");

        // 获取IIS Express开发证书
        X509Certificate2 cert = null;
        using (var store = new X509Store(StoreName.My, StoreLocation.CurrentUser))
        {
            store.Open(OpenFlags.ReadOnly);
            var certs = store.Certificates.Find(X509FindType.FindBySubjectName, "localhost", false);
            cert = certs.Find(c => c.FriendlyName == "IIS Express Development Certificate", false);
        }

        if (cert == null)
        {
            Console.WriteLine("错误：未找到IIS Express开发证书");
            return;
        }

        // 修改配置文件
        if (!File.Exists(configPath))
        {
            Console.WriteLine("错误：未找到IIS Express配置文件");
            return;
        }

        XDocument configDoc = XDocument.Load(configPath);
        var bindingElement = configDoc.Descendants("binding")
            .FirstOrDefault(b => b.Attribute("protocol")?.Value == "https" && 
                                 b.Attribute("bindingInformation")?.Value.Contains($":{targetPort}:") == true);

        if (bindingElement != null)
        {
            bindingElement.SetAttributeValue("certificateHash", cert.Thumbprint);
            bindingElement.SetAttributeValue("certificateStoreName", "My");
            configDoc.Save(configPath);
            Console.WriteLine($"成功将证书绑定到端口 {targetPort}");
        }
        else
        {
            Console.WriteLine($"错误：未找到端口 {targetPort} 的HTTPS绑定");
        }
    }
}

使用CMD脚本实现 #

CMD原生处理XML和证书逻辑较繁琐，通常建议调用PowerShell脚本执行：

@echo off
powershell -ExecutionPolicy Bypass -File "配置证书脚本.ps1"

内容的提问来源于stack exchange，提问作者the1.9gpaProgrammer