Skip to content

Provision certificates to Microsoft IIS

Provision a certificate from Certificate Manager - SaaS to a Windows server that runs Microsoft Internet Information Services (IIS). Certificate Manager - SaaS installs the certificate in the certificate store you choose, and it can also bind the certificate to an IIS web site.

Before you begin

  • A Microsoft IIS machine that you created and whose status is Verified.
  • The certificate to provision in the Certificate Manager - SaaS inventory, with its private key.
  • The System Administrator or PKI Administrator role, or the Resource Owner role and membership in the machine's owning team.
  • IIS 10.0 or later on the server, with the WebAdministration PowerShell module.
  • To bind the certificate, the name of an IIS web site that already exists on the server.

  • If your organization allows only signed PowerShell scripts on the server, the code signing certificate that signs the Certificate Manager - SaaS scripts in the server's Trusted Publishers store. Certificate Manager - SaaS runs signed PowerShell scripts over WinRM to install and bind certificates. Trusted publisher certificates are usually distributed through Group Policy by your Active Directory administrators.

    Code signing certificate in PEM format 
    -----BEGIN CERTIFICATE-----
MIIHkjCCBXqgAwIBAgIQBgA2T7ITSsnbtRYegJ4l6DANBgkqhkiG9w0BAQsFADBp
MQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMT
OERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0
IDIwMjEgQ0ExMB4XDTI2MDkyNDAwMDAwMFoXDTI3MDkyMzIzNTk1OVowgZkxCzAJ
BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRQwEgYDVQQHEwtTYW50YSBD
bGFyYTEhMB8GA1UEChMYUGFsbyBBbHRvIE5ldHdvcmtzLCBJbmMuMRkwFwYDVQQL
ExBFbmdpbmVlcmluZyBWYWFTMSEwHwYDVQQDExhQYWxvIEFsdG8gTmV0d29ya3Ms
IEluYy4wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDXEoMfbTbxsvVa
m0u6eml6k/yHeA9r0yUamSW0LSOUuLzGpuq0lvuzolkMYGRqlPFXDDdOKali4HyH
sq/xTll1UqUXfETXD/c3OMcZHStIwaWAlo5KhvffZs9qHvZ5WHB0gSoDJjUY7nM2
TgAG6T+9xAdUFRVREMzgjFLV3LoILx4LCDhQwQndk+dMY8ngrkrE//N/G2ad15kn
G6MEIsOTORUqXMs/9LTEkr65tUamAFOPkszlcnAQ1xmRzkCSFxw4N2LVSCWIxmrZ
0im9/pVTXwR4XaG7R1QyzIX/wMN/cYrglJgOVt+6IbIG/S68NGZH9g5LYL2EcTP4
Ki/3x3zEEi8UJ6IJ82tfv5e/Yr7hFg9Exzaau6rmIylr+IrjIcT0SJPX95FOEozv
TV2lP459Wsk3mQg0M0KLF0W9EL6SwDfh+oWuejfGDAtq5TKDV/qDodECZr/8hgE5
e0m0LajxHAT0aROSnjU4moqaN6EUKKHbCvCwMuirJKWsGx0/0D613gUywt6cEG0z
69pJFwm3T0tAa7vUkYjD5j1UFqIy965Co7s0stexvhfQLqnsSIEYfmcAzmj94pvm
oE/IXpCr6in91kvTv7Wvx+ZwxKX+IVMJvgQuoKw4NDBjOWNXUfZQBznrpILus8o+
ONK1cEpXh2jAtgDdSTS+KWIEMobyEwIDAQABo4ICAzCCAf8wHwYDVR0jBBgwFoAU
aDfg67Y7+F8Rhvv+YXsIiGX0TkIwHQYDVR0OBBYEFK24lFT/8MnwqCz4ol4xBO0N
lfv9MD4GA1UdIAQ3MDUwMwYGZ4EMAQQBMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93
d3cuZGlnaWNlcnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYI
KwYBBQUHAwMwgbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0cDovL2NybDMuZGlnaWNl
cnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0
MjAyMUNBMS5jcmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp
Q2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3Js
MIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGln
aWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5j
b20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIx
Q0ExLmNydDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQAgLKMeHbYCDN1S
PJELMA/8BPtutmNup27jrc/5n9BGoXdrD6gJgKXJVYYsAVZpe+S3V0XDqi5N5PgR
lw74Jr5IbPSQfrgWgL9hkMzBMoIT4R9YsAQ0lQFREgexuZhVnZXViWc7WwpSBs62
1j+kE3E7zhCFiibnXvMjgVuAXls6SlikGuvdD/Pex7ZECz3IsS7Pf6CbqYbznTTf
9dXIKGPyMoZDLGmedDvCQWeubqS1k9lUIv06knKZw6EY/LXENSb15kzrkF6/MfHE
aGDpxUsLGL8DIK0kAjl2brwBWrhdVc6OPJp4SZXqjm9+/ZhC6dQQclVTb29BToug
nN3IRBXtqHdXDkj0IEUYVuwLCx9P1IpMqOoXsDZp+CwCi6jy6jIflWpDv/5NRnZs
iXKTbddsJLlrO21uNJusmhZcKFkq0prIoFuL6/yImG8DJ/UQGxISoGpfeURHI9JA
V64jCRaJuydeeVENS6wm429WfgQ/fARxFg7YPRTwbHwurGQzHT/03Z2eiNgRnoi2
xmApiycAIEu1bOdBGYZ9nUHRuoVRnESYAiNCqW3c7DqIIRpPAoCSYsBx8mPWknX8
nXJHUFzFKDNH/j86tS43wmCgKPDW+zdarepfEmrg+lpUE3OhIHBnrB0qRxEU4N0Y
fX7EDfCAv7velGAWDsLxrAPmCcoGhA==
-----END CERTIFICATE-----

To provision a certificate to Microsoft IIS

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click the more options button at the end of the machine's row, and then select Provision.

  4. In Search a certificate by name, expiration or fingerprint, enter part of the certificate's name, expiration date, or fingerprint, and then select the certificate from the results. Confirm that it's the right certificate by checking Subject DN, Validity, and Certificate SHA1 Fingerprint.

    The rest of the Provision a certificate dialog appears after you select a certificate.

  5. Under Certificate Information, for CAPI Store, choose the certificate store under the server's local computer account: Personal or Web Hosting.

  6. In Friendly Name, enter the name the certificate shows in Windows and IIS. You can use letters, numbers, spaces, hyphens (-), underscores (_), periods (.), asterisks (*), and parentheses.
  7. (Optional) To let the private key be exported from the server after installation, enable Allow Private Key to be Exported. By default, the private key isn't exportable.
  8. (Optional) To bind the certificate to an IIS web site, under Installation Endpoint, enable Bind Certificate to IIS Web Site. The binding fields appear.
  9. If you enabled the binding, in IIS Web Site Name, enter the name of the IIS web site.

  10. (Optional) To create an HTTPS binding on the web site if a matching one doesn't exist, enable Create Binding if not found.

    Note

    If no binding matches and this option is disabled, Certificate Manager - SaaS still installs the certificate in the certificate store, but provisioning fails.

  11. (Optional) In Binding IP Address, enter the IPv4 address of the binding. The default, 0.0.0.0, binds to all unassigned addresses.

  12. (Optional) In Binding Port, replace the default, 443, if the binding uses a different port.
  13. (Optional) In Binding Hostname, enter the host name of the binding.

  14. (Optional) To turn on Server Name Indication (SNI) for the binding, enable Require Server Name Indication. This option requires Binding Hostname.

    Note

    Without SNI, the binding is matched by IP address and port. If another web site already uses that IP address and port, provisioning fails.

  15. (Optional) To stop and start the web site after the binding changes, enable Restart the IIS Web Site.

  16. (Optional) To save the installation without pushing the certificate now, disable Push certificate on save.
  17. Click Save. To save and then provision another certificate, click Save & New.

After you save, an installation appears on the machine's Installations tab. Certificate Manager - SaaS installs the certificate in the store you chose and its issuing chain in the server's intermediate and trusted root certificate stores. If the certificate is already in the store, Certificate Manager - SaaS updates its friendly name. If you enabled the binding, Certificate Manager - SaaS then updates or creates the web site's HTTPS binding to use the certificate. To provision on a schedule instead of right away, set up a machine provisioning schedule.