Microsoft IIS¶

Tip

Before proceeding, verify that the machine is already created in Certificate Manager - SaaS. Also, ensure that you’ve completed the prerequisite configuration steps for the Microsoft IIS machine.

In the Certificate Manager - SaaS toolbar, click Machines.
Click the more options button at the right end of the Microsoft IIS machine's row, and then select Provision. The Provision a certificate modal opens.
From the Choose a certificate from the inventory field, begin typing the certificate name you want to provision. Click the certificate when you see it listed.

Verify that you've selected the correct certificate by reviewing the Subject DN, Validity, and Fingerprint.
From the CAPI Store drop down, select the certificate store you want the certificate installed in. The Web Hosting store is recommended for certificates used by IIS.
Enter a Friendly Name for this certificate. The certificate will appear with this name when used in IIS.
(Optional) If you want to bind the certificate to the IIS website, toggle the Bind Certificate to IIS Web Site slider to the on position. In the IIS Web Site Name field, enter the site from your IIS server that you want to provision the certificate to.
1. If you want Certificate Manager - SaaS to create a new binding if a matching binding isn't found, click the Create Binding if not found slider.
  
  What happens if I don't choose this and the binding doesn't exist?
  
  If the specified binding doesn't exist and you've told Certificate Manager - SaaS not to create it, the certificate will be added to the CAPI store, and provisioning will result in an error.
2. In the Binding IP Address field, enter an IP address that is bound to Windows. The certificate will be available only for the IP address you enter here. Leave the field empty if you want the certificate to be available an all of the Windows server's IP addresses.
3. In the Binding Port, enter a port number to add to the binding.
4. In the Binding Hostname, enter a hostname to add to the binding if you want the binding to use Server Name Indication (SNI).
5. Enable the Require Server Name Indication toggle to enforce SNI for the binding.
6. Enable the Restart the IIS Web Site instance toggle to restart the IIS web site automatically. Otherwise, restart it manually before using the certificate.
If you don't want the certificate to be pushed when you save, toggle the Push upon saving slider to No.

Click Save.

Want to schedule your provisions?

Schedule your provisions daily, weekly, or monthly. Learn more

Are you requiring strict enforcement of PowerShell script signing?

The Microsoft IIS provisioning process uses PowerShell over WinRM to install certificates on the Windows machine. Certificate Manager - SaaS PowerShell scripts are signed using Venafi's DigiCert CodeSigning certificate. If your organization enforces strict signing requirements to execute PowerShell scripts, ensure Venafi's CodeSigning certificate is included of the Trusted Publishers location on the machine's CAPI store.

Typically, trusted publisher certificates are managed and distributed via Group Policy by your Active Directory administrators.

You can find the certificate in PEM format for your convenience here: