How to install an SSL certificate on IIS

IIS serves HTTPS once the certificate and its private key sit in the Local Computer → Personal store and the site has an https binding on port 443 that uses it. Add the intermediate, redirect HTTP with URL Rewrite, and plan renewal. The steps apply to IIS 10 on Windows Server 2019, 2022 and 2025, using IIS Manager or PowerShell.

Prerequisites

You need administrator rights on the server and a certificate, or the ability to request one.

• Windows Server with the Web Server (IIS) role and the IIS Management Scripts and Tools feature (for the WebAdministration PowerShell module).
• A site in IIS answering on port 80, for example Default Web Site, with host name example.com.
• DNS A/AAAA records for example.com pointing at the server, for example 203.0.113.10, and TCP 443 open in Windows Firewall and any network firewall.
• Either a PFX file (certificate, intermediates and private key) from your CA, or a CA account where you will submit a CSR.

Step 1: Get the certificate into the machine store

IIS can bind a certificate only when its private key is in the Local Computer → Personal store. How you get it there depends on the files your CA gave you.

If you have a PFX file, import it into Local Computer → Personal from an elevated PowerShell:

$pfxPassword = Read-Host -AsSecureString "PFX password"
$cert = Import-PfxCertificate -FilePath C:\certs\example.com.pfx `
  -CertStoreLocation Cert:\LocalMachine\My -Password $pfxPassword
$cert.Thumbprint

If you need a CSR, open IIS Manager → server node → Server Certificates → Create Certificate Request, enter example.com as the common name, choose RSA with 2048 bits, save the request file and submit it to your CA. When the CA returns the certificate, use Complete Certificate Request on the same server, because the private key never left it. To generate a CSR elsewhere, see the CSR generator.

If you have PEM files (for example from Let's Encrypt), convert them to PFX first; on older Windows versions add -legacy:

openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out example.com.pfx

Step 2: Make sure the intermediate certificate is installed

IIS sends the intermediates it finds in the machine's Intermediate Certification Authorities store. If your PFX lacked them, import the intermediate your CA provides:

Import-Certificate -FilePath C:\certs\intermediate.cer -CertStoreLocation Cert:\LocalMachine\CA

See install an intermediate certificate for how to find the right file.

Step 3: Add the HTTPS binding

In IIS Manager: select the site → Bindings → Add → type https, port 443, host name example.com, tick Require Server Name Indication, choose the certificate. Or in PowerShell:

Import-Module WebAdministration
New-WebBinding -Name "Default Web Site" -Protocol https -Port 443 -HostHeader "example.com" -SslFlags 1
$binding = Get-WebBinding -Name "Default Web Site" -Protocol https -HostHeader "example.com"
$binding.AddSslCertificate($cert.Thumbprint, "My")

Step 4: Redirect HTTP to HTTPS

Install the IIS URL Rewrite module from Microsoft, then add this rule to the site's web.config:

<configuration>
  <system.webServer>
    <rewrite>
      <rules>
        <rule name="HTTP to HTTPS" stopProcessing="true">
          <match url="(.*)" />
          <conditions>
            <add input="{HTTPS}" pattern="^OFF$" />
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
        </rule>
      </rules>
    </rewrite>
  </system.webServer>
</configuration>

Keep the port-80 binding so the redirect can answer; do not tick Require SSL, which returns 403 on HTTP instead of redirecting.

Verify

The public site should present your CA's certificate for example.com with a complete chain, and HTTP should redirect to HTTPS. Check it with the SSL checker, or from any terminal:

curl ssl.sh/example.com

On the server, confirm the binding and the certificate HTTP.sys uses:

Get-WebBinding -Name "Default Web Site"
netsh http show sslcert hostnameport=example.com:443

Automatic renewal

IIS itself does not renew certificates. With a commercial certificate you repeat Steps 1 and 3 before every expiry, and since March 15, 2026 public certificates last at most 200 days (100 days from March 15, 2027 and 47 days from March 15, 2029), so manual renewal no longer scales. Two options automate it:

• Use win-acme to get Let's Encrypt certificates and update the IIS binding automatically via a scheduled task.
• If your commercial CA supports ACME (many do, with External Account Binding), point win-acme at the CA's ACME endpoint instead.

Add the site to ssl.sh monitoring (in development) as well, so an expiring binding is caught in time.

Troubleshooting

• A specified logon session does not exist: the private key is missing or in the wrong store; re-import the PFX into Local Computer → Personal.
• Complete Certificate Request fails, or the certificate disappears from the list: the request was created on another server, so the private key is not here; import a PFX from the original server or create a new CSR.
• Browsers accept the site but other clients report an untrusted chain: the intermediate is missing; see missing intermediate certificate.
• ERR_SSL_VERSION_OR_CIPHER_MISMATCH: no binding matches the requested host name, or Schannel has no protocol in common with the client; see ERR_SSL_VERSION_OR_CIPHER_MISMATCH.
• Certificate name mismatch: the binding's host name or the certificate's SAN does not include the requested name; see NET::ERR_CERT_COMMON_NAME_INVALID.