Microsoft IIS¶

In the TLS Protect Cloud toolbar, click Machines.
Click the checkbox next to the Microsoft IIS machine that you want to provision a certificate to.
Click Provision a certificate. The Provision a certificate modal opens.
From the Choose a certificate from the inventory field, begin typing the certificate name you want to provision. Click the certificate when you see it listed.

Verify that you've selected the correct certificate by reviewing the Subject DN, Validity, and Fingerprint.
From the CAPI Store drop down, select the certificate store you want the certificate installed in. The Web Hosting store is recommended for certificates used by IIS.
Enter a Friendly Name for this certificate. The certificate will appear with this name when used in IIS.
(Optional) If you want to bind the certificate to the IIS website, toggle the Bind Certificate to IIS Web Site slider to the on position. In the IIS Web Site Name field, enter the site from your IIS server that you want to provision the certificate to.
If you want TLS Protect Cloud to create a new binding if a matching binding isn't found, click the Create Binding if not found slider.

What happens if I don't choose this and the binding doesn't exist?

If the specified binding doesn't exist and you've told TLS Protect Cloud not to create it, the certificate will be added to the CAPI store, and provisioning will result in an error.
In the Binding IP Address field, enter an IP address that is bound to Windows. The certificate will be available only for the IP address you enter here. Leave the field empty if you want the certificate to be available an all of the Windows server's IP addresses.
In the Binding Port, enter a port number to add to the binding.
In the Binding Hostname, enter a hostname to add to the binding if you want the binding to use Server Name Indication (SNI).
If you don't want the certificate to be pushed when you save, toggle the Push upon saving slider to No.

Click Save.

Want to schedule your provisions?

Schedule your provisions daily, weekly, or monthly. Learn more

Are you requiring strict enforcement of PowerShell script signing?

The Microsoft IIS provisioning process uses PowerShell over WinRM to install certificates on the Windows machine. TLS Protect Cloud PowerShell scripts are signed using Venafi's DigiCert CodeSigning certificate. If your organization enforces strict signing requirements to execute PowerShell scripts, ensure Venafi's CodeSigning certificate is included of the Trusted Publishers location on the machine's CAPI store.

Typically, trusted publisher certificates are managed and distributed via Group Policy by your Active Directory administrators.

You can find the certificate in PEM format for your convenience here: