Bridge SSL
Bridge CDN →

Install an SSL certificate on IIS

12 min readUpdated

IIS does not read certificate files from a path in its configuration. It uses the Windows certificate store: the certificate and its private key are imported there, and a site serves it through an HTTPS binding. To install an SSL certificate on IIS, get the certificate into the store by one of two routes, depending on where the signing request was created, and bind it to the site.

Steps common to every server are on installing a certificate. Menu names below are those of IIS Manager in IIS 10.0, the version that shipped with Windows Server 2016 [1].

Where the certificate lives
the Personal (My) or Web Hosting (WebHosting) store of the local computer, with its private key [4]
What you import
the authority's response to a request made on this server, or a PFX file [5]
What serves it
an https binding; HTTP.sys holds its certificate hash and store name [6]
PowerShell
Import-PfxCertificate (PKIClient module) and New-IISSiteBinding (IISAdministration module 1.1.0.0 or later) [7][4]
After renewal
rebind, or let Certificate Rebind do it (IIS 8.5 and later) [8]

How IIS keeps certificates

On IIS, the SSL certificate and its private key live in the machine's store [2][4]. Servers configured by file path work differently: to install an SSL certificate on nginx, you point its configuration at a certificate file and a key file; installing an SSL certificate on Apache works the same way. Intermediates go to their own store, Intermediate Certification Authorities [9].

  • You import rather than copy. For a certificate requested elsewhere the import file is a PFX, a password-protected PKCS#12 bundle that carries the certificate, the key and, when it was built with them, the intermediates [7][10]. See certificate formats.

  • The key may not be exportable. On import you choose whether it can be exported again later [5].

  • The binding points at one certificate. A renewed certificate is a new entry in the store, and the site keeps serving the old one until the binding changes [8].

Personal, Web Hosting or a file share

The Web Hosting store appeared in IIS 8.0, together with Server Name Indication [2]. Both stores work the same way for import and export. Web Hosting is designed to scale to more certificates, so pick it on a server with many HTTPS sites [2]. For a server farm, IIS 8.0 and later can also load certificates from a file share, the Centralized Certificate Store: each PFX file is named after its hostname, for example www.example.com.pfx, and IIS picks the file by the name the client asks for [11].

Before you start

  • Administrator access to the server. The local computer store is shared by every user of the machine; without administrator rights you manage certificates only for your own account [9].

  • The site name and hostname you are binding.

  • The authority's response to a request created in IIS on this server, or a PFX file and its password.

Put the certificate in the store

Route 1: complete a request created in IIS

Use this route when the signing request was created on this server, in IIS Manager. The matching private key is already in the store, and the response can be installed only on the computer that sent the request [5].

  1. In IIS Manager, select the server in the Connections pane and open Server Certificates.

  2. Choose Complete Certificate Request… in the Actions pane.

  3. Select the file the authority returned, for example a .cer file, enter a friendly name, and choose the Personal or Web Hosting store. The friendly name is a label in the store, not part of the certificate [3].

  4. Click OK. The SSL certificate appears in the list, paired with its key.

If the authority sent intermediates as separate files, import them into Intermediate Certification Authorities with the Certificates console, certlm.msc [9]. Requests are created with Create Certificate Request… in the same pane [5]; see generating a CSR in IIS step by step, and CSR for what a request contains.

If the certificate appears without a private key, or disappears from the list after completing, the key stayed on the machine or account that created the request. Complete it there and export a PFX.

Route 2: import a PFX file

Use this route when the SSL certificate was requested on another machine, or by a tool other than IIS.

  1. In Server Certificates, choose Import… in the Actions pane.

  2. Select the .pfx file and enter its password.

  3. Choose the Personal or Web Hosting store.

  4. Leave Allow this certificate to be exported cleared unless you will move this private key to another server, and click OK [5].

If the certificate and key are PEM files, for example from a Linux server or an ACME client, combine them into a PFX first:

$ openssl pkcs12 -export -out example.com.pfx -inkey example.com.key -in example.com.crt -certfile intermediate.crt

-certfile adds the intermediate, so it is imported with the certificate [10]. Enter OpenSSL's export password during the import. Moving a certificate and its key between Windows servers is covered in the guide to importing certificates and exporting them.

Bind the certificate to the site

  1. In Connections, expand Sites, select the site and choose Bindings… in the Actions pane [6].

  2. Click Add… for a new binding, or Edit… with an existing https binding selected.

  3. Set Type to https, IP address to All Unassigned or the site's address, and Port to 443 [3].

  4. Enter the hostname in Host name, and select Require Server Name Indication when more than one HTTPS site shares this address and port [11].

  5. Choose the certificate under SSL certificate and click OK.

The hostname must be covered by the certificate, or visitors get a name mismatch error [2]. See Subject Alternative Names.

Require Server Name Indication makes IIS choose the certificate by the hostname the browser sends, called SNI, a TLS extension defined in RFC 6066 [12]. Without it, a binding is identified by address and port only, and only one certificate can be bound to that pair [6].

Warning. A binding change takes effect on the live site immediately. Keep the previous certificate in the store until you have checked the new binding from outside; to go back, select the old certificate again.

The same with PowerShell

The IISAdministration module was introduced with IIS 10.0, and New-IISSiteBinding arrived in module version 1.1.0.0; newer versions are on the PowerShell Gallery [4]. Get-Module -ListAvailable IISAdministration shows the version installed [7]. Run PowerShell as administrator:

$password = Read-Host -AsSecureString
$cert = Import-PfxCertificate -FilePath C:\certs\example.com.pfx -CertStoreLocation Cert:\LocalMachine\My -Password $password
New-IISSiteBinding -Name "Example" -BindingInformation "*:443:example.com" -Protocol https -CertificateThumbPrint $cert.Thumbprint -CertStoreLocation "Cert:\LocalMachine\My" -SslFlag Sni

-BindingInformation takes address, port and hostname separated by colons, where * means all addresses [4]. -SslFlag Sni is the Require Server Name Indication checkbox [4][6]. Import-PfxCertificate leaves the key non-exportable unless you add -Exportable [7]. Parameters are documented on New-IISSiteBinding.

Verify from outside

Check from another machine after every IIS certificate installation, against each hostname:

$ openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null

Confirm that the served certificate is the new one, the intermediate is sent, and the hostname is covered. -showcerts lists the certificates exactly as the server sent them, and -servername puts the hostname into the SNI extension [10]. Windows includes curl: in Windows PowerShell 5.1 run curl.exe -I https://example.com/, because plain curl there is an alias of Invoke-WebRequest [13]. More checks are on OpenSSL commands.

A browser on the server itself can trust the chain from its own store even when IIS does not send the intermediate.

To see what is bound at the network level, run netsh http show sslcert. The site's binding is stored in applicationHost.config, while HTTP.sys keeps its own SSL entry for each address and port, or hostname and port, with the certificate hash and store name [2][6].

Renewal on IIS

Renewal of an SSL certificate on IIS is two steps: put the new certificate in the store, then switch the HTTPS binding to it. The site must be rebound even when certificates renew automatically; a site left on the old certificate shows visitors an expiration warning once it runs out [8]. Check the thumbprint in netsh http show sslcert against the new certificate after every renewal.

IIS 8.5 and later can do the second step. Enable Automatic Rebind of Renewed Certificate, in the Actions pane of Server Certificates, registers a scheduled task that reacts to the certificate-renewal event (event ID 1001) and moves the sites bound to the old thumbprint to the new one [8]. Microsoft describes it for renewals made by hand in Windows or through autoenrollment; for a certificate from elsewhere, check the binding.

An ACME client for Windows can do both steps on a schedule. It has to update IIS bindings, not only the store; see ACME clients. The wider process, including an already expired certificate, is on renewal.

With the Centralized Certificate Store the binding carries no certificate hash, so a renewed file on the share under the same name needs no rebinding [11].

Common mistakes on IIS

  • The intermediate was not imported. IIS sends only the chain it can build from the store, so the certificate goes out alone.

  • Two sites share an address and port without SNI. One of them shows a name mismatch.

  • The key cannot be exported. The certificate then cannot move to a new server; issue a new one there.

  • SNI and IP-based bindings on one server. Microsoft lists corner cases in which IIS Manager removes an unintended SSL binding in this mix; netsh http show sslcert shows what is actually bound [2].

Automate this with Bridge SSL

Bridge SSL issues certificates and serves them with their full chain, so importing into the store, binding and rebinding after renewal disappear from the process. Renewal happens on a schedule rather than as work on the server. See what the platform offers at Bridge CDN.

FAQ

How do I install an SSL certificate on IIS?

Import the certificate into the server's store: Complete Certificate Request if the request was created in IIS, Import for a PFX file. Then add an https binding on port 443 and select the certificate.

What file format does IIS need?

A PFX file with the certificate and its private key, for certificates requested elsewhere. A .cer or .crt file is enough only to complete a request created in IIS on the same server.

Why does my certificate disappear after Complete Certificate Request?

The request was created on another machine or account, so the private key is not here. IIS installs the response only on the computer that sent the request. Complete it there, export a PFX and import that.

What does Require Server Name Indication do in IIS?

It makes IIS choose the certificate by the hostname the browser sends, which is needed when several HTTPS sites share one IP address and port 443.

How do I add an SSL binding with PowerShell?

Use New-IISSiteBinding with -Protocol https, -BindingInformation "*:443:example.com", the certificate's thumbprint and store location, and -SslFlag Sni for name-based selection.

Why does IIS still serve the old certificate after renewal?

The binding still points at the old certificate. Select the new one in the https binding and check the thumbprint with netsh http show sslcert.

Sources

  1. Microsoft Learn, New Features Introduced in IIS 10.0: IIS 10.0 shipped with Windows 10 and Windows Server 2016.

  2. Microsoft Learn, IIS 8.0 Server Name Indication (SNI): SSL Scalability: SNI and the Web Hosting store in IIS 8.0, host name matching, the IIS Manager corner case with mixed bindings.

  3. Microsoft Learn, PowerScribe One SSL certificate renewal: the IIS 10 Complete Certificate Request and Add Site Binding dialogs.

  4. Microsoft Learn, IISAdministration PowerShell Cmdlets and the New-IISSiteBinding reference: module history, accepted store paths, SslFlag values.

  5. Microsoft Learn, Request, Install and Import a Server Certificate (IIS 7): Create Certificate Request, Complete Certificate Request on the requesting computer only, Allow this certificate to be exported.

  6. Microsoft Learn, How to Set Up SSL on IIS 7 or later, and the Binding element reference: applicationHost.config and HTTP.sys, netsh http show sslcert, sslFlags.

  7. Microsoft Learn, PowerShell reference: Import-PfxCertificate, Read-Host, Get-Module.

  8. Microsoft Learn, Certificate Rebind in IIS 8.5.

  9. Microsoft Learn, How to: View certificates with the MMC snap-in, and Install certificates for SQL Server Management Studio: local computer stores, certlm.msc, the Intermediate Certification Authorities store.

  10. OpenSSL, openssl-pkcs12 and openssl-s_client manual pages.

  11. Microsoft Learn, IIS 8.0 Centralized SSL Certificate Support: SSL Scalability and Manageability.

  12. IETF, RFC 6066, Transport Layer Security (TLS) Extensions, section 3, Server Name Indication.

  13. Microsoft Learn, curl on Windows.