HttpListener class with HTTPS support

There seems to be a lot of confusing, sometimes conflicting, information with regards to making a .NET `HttpListener` HTTPS capable. My understanding is as follows: One's C# code needs an `https` prefix (for example, `https://*:8443`) in order for the listener to understand that it needs to service SSL requests at this port. The actual SSL handshake happens under the covers and is handled by `http.sys` (buried somewhere on the Windows machine). The C# code doesn't have to explicitly manage the SSL handshake, because it happens under the covers. One needs to have a "X.509 trusted certificate" on the `httpListener` machine, and somehow that certificate needs to be bound to port 8443 (in this example). Is my understanding above correct? If not, please educate me. Regarding X.509 certificates, my understanding is: - Use `makecert` to create an X.509 certificate. This certificate gets stored in the personal store and needs to get moved over to the Trusted Store (this is where the HTTP listener will look). It seems I can use `certMgr` to perform the move, or I can use `mmc` to effect the move. It seems there is more than one X.509 certificate format (`DER`, `Base64`, `pks`, pswd protected, `pks` private, etc.)... Is there a preferred format I should use? Once I get the certificate into the trusted store, I need to bind it to the TCP port. I am on Windows 7: should I be using `httpcfg` or `netsh`?