How to Generate and Install an SSL Certificate in IIS on Windows Server

Introduction

An SSL/TLS certificate secures communication between a website and its users by encrypting data transmitted over HTTPS. In Microsoft IIS (Internet Information Services), you can generate a Certificate Signing Request (CSR), submit it to an SSL certificate provider, install the issued certificate, and bind it to your website.

This guide explains how to generate a CSR in IIS, obtain an SSL certificate from an SSL provider, install the certificate, and configure HTTPS for an IIS website

Prerequisites

Before generating and installing the SSL certificate, ensure that:

• IIS is installed and configured on the Windows Server.
• You have administrative access to the Windows Server.
• The website is already created and configured in IIS.
• You have access to the domain for which the SSL certificate will be issued.
• You have access to an SSL certificate provider.
• The required DNS records for the domain are properly configured.
• Port 443 is allowed through the Windows Firewall and any external firewall/security groups.
• The SSL provider’s certificate validation requirements can be completed.
• You have permission to install certificates and modify IIS site bindings.

Implementation

Step 1: Generate CSR 

1. Start screen
2. Open IIS Manager
3. Click on server name
4. From the center menu, double-click the “Server Certificates” button in the “IIS” section (it is in the middle of the menu).
5. From the “Actions” menu (on the right), click on “Create Certificate Request…” This will open the Create Certificate Request wizard. Provide the details
   1. Common Name — The fully-qualified domain name (FQDN) — or URL — for which you plan to use your certificate
   2. Organization — The name in which your business is legally registered
   3. Organizational Unit — Use this field to differentiate between divisions within an organization
   4. City/Locality
   5. State/Province
   6. Country — The two-letter International Organization country code
6. For Cryptographic service provider, select Microsoft RSA SChannel Cryptographic Provider.
7. For Bit length, select 2048 or higher, and then click Next.
8. Click …, enter the location and file name for your CSR, and then click Finish.

Now share this csr with your ssl provider and purchase SSL certificate.

Step 2: Install SSL 

1. Start screen
2. Open IIS Manager
3. Click on server name
4. From the center menu, double-click the “Server Certificates” button in the “IIS” section (it is in the middle of the menu).
5. From the “Actions” menu (on the right), click on “Complete Certificate Request…” This will open the Complete Certificate Request wizard
6. Browse to your_domain_name.cer file that was provided to you by ssl Providers. You will then be required to enter a friendly name(yourdomain.tld). The friendly name is not part of the certificate itself, but is used by the server administrator to easily distinguish the certificate. Choose to place the new certificate in the Personal certificate store.
7. Clicking “OK” will install the certificate to the server.
8. Once the SSL Certificate has been successfully installed to the server, you will need to assign that certificate to the appropriate website using IIS
9. Under “Sites,” select the site to be secured with SSL.
10. From the “Actions” menu (on the right), click on “Bindings…” This will open the “Site Bindings” window.
11. In the “Site Bindings” window, click “Add…” This will open the “Add Site Binding” window.
12. Under “Type” choose https. The IP address should be the IP address of the site or All Unassigned, and the port over which traffic will be secured by SSL is usually 443. The “SSL Certificate” field should specify the certificate that was installed in step 6
13. Click “OK.”
14. Your SSL certificate is now installed, and the website configured to accept secure connections.

You can now verify ssl from https://www.sslshopper.com/ssl-checker.html?hostname=google.com

Conclusion

Generating and installing an SSL certificate in IIS involves creating a CSR, submitting it to an SSL certificate provider, installing the issued certificate, and assigning it to the appropriate IIS website through an HTTPS binding.

Once the configuration is completed and verified, users can securely access the website over HTTPS, helping protect data exchanged between the website and its visitors.

FAQs

1. Why is my SSL certificate showing an error?
Check the HTTPS binding, domain name, certificate expiry, and certificate chain.

2. What happens if the private key is missing?
The certificate cannot be used with the original CSR. Generate a new CSR and reissue the certificate.

3. Do I need a new CSR when renewing an SSL certificate?
Not always, but generating a new CSR provides a new key pair and is generally recommended.

Related Articles

Installing wildcard SSL in windows which you are already using in Linux

Talk to our DevOps experts:

Looking for the right technology solution for your business?. Our experts can help with web hosting, domain registration, DevOps and cloud, software development, web applications, mobile applications, and enterprise solutions. Get in touch with our team here.