Skip to content

Create a Microsoft IIS machine

Create a Microsoft Internet Information Services (IIS) machine so Certificate Manager - SaaS can discover the certificates on a Windows server that runs IIS and provision certificates to it. Certificate Manager - SaaS connects to the server through Windows Remote Management (WinRM) from a VSatellite.

Before you begin

  • The System Administrator, PKI Administrator, or Resource Owner role. If you have the Resource Owner role, you must own or belong to at least one team.
  • An active VSatellite that can reach the Windows server on its WinRM port and, if you use Kerberos authentication, the Key Distribution Center.
  • IIS 10.0 or later on the server, with the WebAdministration PowerShell module. Discovery and provisioning both fail on earlier IIS versions.
  • WinRM set up on the server for the authentication method you plan to use, and an HTTPS listener if you plan to connect over HTTPS. See To prepare the Windows server.
  • An account that's a member of the local Administrators group on the server. For Kerberos authentication, use an Active Directory domain account. For Basic authentication, use a local account.
  • For Kerberos authentication, the server's Active Directory domain name, the address of a Key Distribution Center (domain controller) for the domain, and the server's WinRM service principal name (SPN). To find the SPN, see To prepare the Windows server.

Make sure the required Windows Remote Management (WinRM) ports are open from the VSatellite to the target Windows server. Firewalls or network security controls that block these ports stop certificate provisioning and discovery, where the machine type supports it.

Required ports

Purpose Protocol Port When required
WinRM over HTTP TCP 5985 When the machine uses WinRM over HTTP (for example, Kerberos over HTTP).
WinRM over HTTPS TCP 5986 When the machine uses WinRM over HTTPS (for example, Kerberos over HTTPS or Basic Authentication over HTTPS).
Kerberos authentication TCP and UDP 88 Whenever the machine uses Kerberos authentication. The VSatellite must reach the Kerberos service of a domain controller.

Important

  • Confirm that TCP 5985, TCP 5986, or both are reachable if you use the default WinRM listener configuration.
  • When you use Kerberos authentication, verify that TCP/UDP 88 is open between the VSatellite and your domain controller.
  • If your environment uses custom WinRM ports, make sure those ports are reachable.
  • Blocked ports often cause Test Access failures or authentication errors during machine creation or certificate provisioning.

To prepare the Windows server

Certificate Manager - SaaS connects to the Windows server through Windows Remote Management (WinRM). Run these commands on the server in a PowerShell window that you open with Run as administrator. Which sections apply depends on the Authentication Type you plan to choose and on whether you plan to enable Use TLS for WinRM.

Turn on WinRM

All machines need this section. Turn on the WinRM service and create the default HTTP listener on port 5985. If WinRM is already turned on, you can skip this command.

winrm quickconfig -quiet

Turn on the authentication method

Turn on the authentication method you plan to choose for the WinRM service.

Kerberos authentication. Kerberos is turned on by default. This command makes sure it's still turned on:

winrm set winrm/config/service/auth '@{Kerberos="true"}'

Over HTTP, Certificate Manager - SaaS encrypts Kerberos traffic itself, so you don't need to change the WinRM AllowUnencrypted setting.

Basic authentication. Basic is turned off by default. To turn it on, run this command:

winrm set winrm/config/service/auth '@{Basic="true"}'

With Basic authentication, Certificate Manager - SaaS doesn't encrypt the traffic itself. Create an HTTPS listener, as described in the next section, and enable Use TLS for WinRM on the machine.

Create an HTTPS listener

You need this section only if you plan to enable Use TLS for WinRM.

  1. Install a TLS server certificate on the server. The certificate needs the Server Authentication extended key usage, and it must be in the local computer's Personal store (LocalMachine\My, or Local Computer > Personal in the Certificates snap-in).

    Certificate Manager - SaaS doesn't verify the listener's certificate, so a self-signed certificate works. The connection is still encrypted.

  2. Find the certificate's thumbprint:

    Get-ChildItem -Path Cert:\LocalMachine\My

  3. Create the HTTPS listener on port 5986. Replace <thumbprint> with the certificate's thumbprint:

    winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{CertificateThumbprint="<thumbprint>"}'

  4. If Windows Defender Firewall is turned on, allow inbound connections to port 5986. The winrm quickconfig command opens only port 5985.

    New-NetFirewallRule -DisplayName "Windows Remote Management (HTTPS-In)" -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Allow

Find the service principal name

You need this section only if you plan to choose Kerberos Authentication. List the server's service principal names (SPNs), where <hostname> is the server's computer name:

setspn -L <hostname>

Use the entry in the format WSMAN/<fqdn>, for example, WSMAN/server.example.com, as the machine's Service Principal Name. Use the same SPN whether or not you enable Use TLS for WinRM.

To create a Microsoft IIS machine

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click New, and then select Microsoft IIS.
  4. On the Properties step, in Name, enter a name for the machine.
  5. For Owning Team, choose the team that owns the machine. System Administrators and PKI Administrators can choose any team. Resource Owners can choose only a team they own or belong to.

  6. For VSatellite, choose a VSatellite that can reach the machine. A VSatellite that's the primary of a high availability group shows its number of active replicas, and Certificate Manager - SaaS can run the machine's operations on any healthy VSatellite in the group.

  7. For Authentication Type, choose Basic Authentication or Kerberos Authentication. To compare them, see Authentication options.

  8. In Microsoft IIS Hostname, enter the hostname, fully qualified domain name (FQDN), or IP address of the Windows server.
  9. (Optional) In Windows Remote Management (WinRM) Port, enter the port of the server's WinRM listener. If you leave it empty, Certificate Manager - SaaS uses 5985, the default HTTP port. If you enable Use TLS for WinRM, enter the HTTPS listener port, which is usually 5986.

  10. (Optional) To connect to the server over HTTPS, enable Use TLS for WinRM.

    Note

    Certificate Manager - SaaS doesn't verify the TLS certificate of the server's WinRM listener. The connection is still encrypted.

  11. If you chose Kerberos Authentication, under Kerberos Details, in Domain Name, enter the Active Directory domain name of the server, for example, example.com.

  12. If you chose Kerberos Authentication, in Key Distribution Center Address/Hostname, enter the hostname or IP address of a domain controller for the domain.
  13. If you chose Kerberos Authentication, in Service Principal Name, enter the server's WinRM SPN in the format WSMAN/<fqdn>, for example, WSMAN/server.example.com.

  14. For Credential Type, choose how to provide the credentials:

    • Enter Credentials to enter the credentials in the next step. This is the default.
    • Select Credentials to use shared credentials from a credential manager integration. Then, for Credential, choose the credential.

    Note

    Select Credentials requires the credential manager capability, which requires additional licensing. Without it, Credential shows No credentials are available. System Administrators and PKI Administrators can choose any credential. Resource Owners can choose only the credentials that belong to their teams.

  15. If you chose Enter Credentials, enter the Username and Password of the Windows account. For Kerberos authentication, enter the username without the domain, for example, jsmith instead of jsmith@example.com. If you chose Select Credentials, the stored account needs the same access on the server.

    Non-ASCII characters aren't supported in the username or password.

    Note

    Certificate Manager - SaaS encrypts the credentials you enter and doesn't display them again. On the machine's Properties tab, they appear masked. To keep a stored credential when you edit the machine, leave its masked value unchanged. Keep your own secure record of the credentials in case you need them again.

  16. Click Test Access. After the connection succeeds, click Continue. The Discovery step opens.

    Note

    A successful test confirms that Certificate Manager - SaaS can reach the server's WinRM listener, sign in, and run a command. It doesn't check the IIS version or the WebAdministration module.

  17. (Optional) Choose the certificate stores to discover: Both Personal and Web Hosting, Personal, or Web Hosting. Discovery searches the stores under the server's local computer account and finds the IIS web site bindings that use each certificate. If you don't choose, discovery searches both stores.

  18. (Optional) To skip certificates that have already expired, enable Exclude expired certificates.

  19. (Optional) To skip certificates that no IIS web site binding uses, enable Exclude inactive certificates.
  20. (Optional) To discover certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).
  21. Click Continue. The Provisioning step opens.

  22. (Optional) To provision certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

    Scheduled provisioning pushes only certificates that are queued for deployment, such as renewed certificates, so renewals install during the window you choose.

  23. Click Finish.

Authentication options

How Certificate Manager - SaaS protects the WinRM connection depends on the Authentication Type you choose and on whether you enable Use TLS for WinRM. Use the most secure option your environment allows. From most to least secure:

  • Kerberos Authentication over HTTPS: TLS encrypts the traffic. Certificate Manager - SaaS sends a Kerberos channel binding token, so you can keep the WinRM CbtHardeningLevel setting at Strict. This option needs a domain-joined server with a WinRM HTTPS listener.
  • Kerberos Authentication over HTTP: Certificate Manager - SaaS encrypts all WinRM traffic with Kerberos message encryption, whatever the server's WinRM AllowUnencrypted setting, so you can keep AllowUnencrypted at false. Message encryption supports the AES encryption types aes256-cts-hmac-sha1-96 and aes128-cts-hmac-sha1-96, and it refuses RC4 and DES. If authentication fails because of the encryption type, make sure the domain issues AES tickets for the account. Use this option for a domain-joined server that doesn't have a TLS server certificate yet.
  • Basic Authentication over HTTPS: TLS encrypts the traffic, including the username and password. This is the only option for a server that isn't joined to a domain.

Warning

Use Basic Authentication only with Use TLS for WinRM enabled. Without TLS, the username and password cross the network unencrypted.

What's next?

After you create the machine, provision a certificate to it. You can also run discovery on the machine at any time to track the certificates on the server.