How to enable WinRM HTTPS transport?

I know the server need a self-signed CA. But how can I generate a CA, and where can I put it to make server's PowerShell 2.0 work? And what is CN matching?

The following is what happens when I run the command winrm quickconfig -transport:https:

WinRM already is set up to receive requests on this machine.
WSManFault
Message
    ProviderFault
        WSManFault
            Message

Error number:  -2144108267 0x80338115
Cannot create a WinRM listener on HTTPS because this machine does not 
have an appropriate certificate. To be used for SSL, a certificate 
must have a CN matching the hostname, be appropriate for 
Server Authentication, and not be expired, revoked, or self-signed.

Solution

Unless you want to go to the trouble of setting up a full-fledged single-tier or two-tier PKI infrastructure (which would be a topic for ServerFault rather than StackOverflow) you could make do with makecert.exe to create a self-signed CA certificate and host certificates signed with it.

Create the CA certificate like this:

& makecert.exe -pe -r `
    -n "CN=TestCA" `
    -ss my `
    -sr LocalMachine `
    -a sha256 `
    -sky signature `
    "TestCA.cer"

Then create certificate for the host:

$cn = if ($env:USERDNSDOMAIN) {
        "$env:COMPUTERNAME.$env:USERDNSDOMAIN"
      } else {
        $env:COMPUTERNAME
      }

& makecert.exe -pe `
    -n "CN=$cn" `
    -ss my `
    -sr LocalMachine `
    -a sha256 `
    -sky exchange `
    -eku 1.3.6.1.5.5.7.3.1 `
    -in "TestCA" `
    -is my `
    -ir LocalMachine `
    -sp "Microsoft RSA SChannel Cryptographic Provider" `
    -sy 12 `
    "$cn.cer"

The CN (Common Name) is the subject of your certificate and for host certificates must match the computer's FQDN.

If you want to create host certificates for other hosts than your local computer you need to set $cn to the name/FQDN of the other computer. To get the certificate and private key to the destination computer export both from your certificate store (<serial> is the serial number of the certificate):

& certutil.exe -exportPFX -f -privatekey -p "password" "<serial>" computer.pfx

Copy computer.pfx to the computer for which you generated the certificate and import it like this:

& certutil.exe -importPFX -f -privatekey C:\path\to\computer.pfx

You'll be prompted for the password you specified when exporting the certificate.

On all machines that should use certificates signed by your TestCA you need to import TestCA.cer under Trusted Root Certification Authorities for the computer account.

& certutil.exe -f -addstore ca C:\path\to\TestCA.cer

Note that makecert.exe isn't available as a separate download anymore, but you can get it from the Windows SDK (download the ISO image and run the SDK Tools installer from the subfolder \setup\WinSDKTools).

Note also that using a makeshift CA like that is strongly discouraged for any kind of production environment.