Install an SSL Certificate in IIS

What IIS needs before a certificate can bind

IIS needs three things to serve HTTPS: a certificate file that still carries its private key, a site binding on port 443, and IIS 8 or later if several sites share one IP. A dedicated IP is not required once SNI is on.

• IIS 8 and later support Server Name Indication, so many certificates can share one address.
• The private key is created with the CSR. A certificate completed on another server has no key and will not bind.
• The intermediate certificate has to be installed too, or Android and older Windows clients show a warning.
• Port 443 must be open in Windows Firewall and in the provider firewall, if there is one.

Import a PFX when the certificate was issued elsewhere

A PFX file holds the certificate, its chain and the private key. Import it when the certificate was bought on another machine or the server was rebuilt, and skip the pending-request step entirely.

1. Copy the .pfx file to the server.
2. Open IIS Manager with inetmgr, click the server name, then double-click Server Certificates.
3. In the Actions pane click Import, choose the .pfx file, type the password from the issuer, and select the Web Hosting store.
4. Refresh the list. The certificate should appear with its subject name and expiry date.

From an elevated prompt, certutil -importPFX -p PASSWORD path\to\cert.pfx does the same thing when IIS Manager is not available.

Complete the pending request with the CA file

If the CSR was generated on this server, the private key is already waiting in the store. Completing the request attaches the issued certificate to it.

1. Save the .cer file the certificate authority sent. Base-64 encoded X.509 is the format IIS expects.
2. In IIS Manager open Server Certificates, then click Complete Certificate Request in the Actions pane.
3. Browse to the .cer file, type a friendly name such as the domain and year, and choose Web Hosting as the store.
4. Click OK. The certificate now appears in the Server Certificates list.

A friendly name is only a label, but it is the only way to tell five certificates for the same domain apart when one is renewed early.

Bind HTTPS with SNI on port 443

The binding is what actually turns HTTPS on. A certificate sitting in the store does nothing until a site points at it.

1. Expand Sites, right-click the site, and choose Edit Bindings.
2. Click Add, set Type to https, IP address to All Unassigned, and Port to 443.
3. Type the host name, for example www.example.com, and tick Require Server Name Indication.
4. Pick the certificate in the SSL certificate dropdown, click OK, then Close.

Reuse the same pattern for every extra host: one https binding per host name, each with SNI ticked and its own certificate. Without the host name, IIS serves the first certificate on the IP to every visitor.

Verify the certificate and the chain

You know it worked when https://www.example.com loads with a padlock, the certificate shows the right common name, and the chain lists the intermediate above the leaf.

1. Open the site in a private window and click the padlock, then Certificate, then the Certification Path tab.
2. Run netsh http show sslcert and find the host name and port 443 entry. The certificate hash there must match the one in IIS Manager.
3. In PowerShell run Get-ChildItem Cert:\LocalMachine\WebHosting | Format-Table Subject,NotAfter,HasPrivateKey.
4. Check NotAfter. A certificate that expires in days is a renewal problem, not a binding problem.

If the padlock shows an exclamation mark, the leaf is fine and the chain is not. Import the issuer's intermediate into Intermediate Certification Authorities and reload. If the browser still blocks the page, work through the not secure warning checklist instead of rebinding.

Get a free certificate on IIS with win-acme

Let's Encrypt certificates are free and valid for 90 days, and on IIS a client does the work: request, binding and renewal task. win-acme is the common choice for Windows Server.

1. Download the win-acme release, extract it, and run wacs.exe as administrator.
2. Choose the option that scans IIS sites, then pick the site from the list.
3. Accept the host name, let it create or reuse the web.config validation path, and confirm the binding.
4. Finish the wizard. A scheduled task now renews the certificate and rebinds the site automatically.

Free certificates are domain-validated only. A business that needs an organisation name in the certificate has to buy an OV or EV product from a paid SSL certificate range.

Fix the errors that stop the binding

When to email WebJi about a Windows certificate

IIS ships with Windows Server, so the server and the certificate usually arrive together on Windows hosting. Email support@webji.services with the exact IIS message, the certificate subject line, and the site binding you changed. Support is 24/7 by email in Hindi and English, and the average first reply is under 60 minutes. The office phone is business hours only and is not a support line.