How to Install SSL Certificate in IIS

Installing an SSL certificate in IIS is a straightforward process once you have the certificate ready. 

Below are the steps to install and configure an SSL certificate in Internet Information Services (IIS) on a Windows server.

Prerequisites

1. SSL Certificate: You need a valid SSL certificate file (e.g., .pfx, .cer, or similar format) from a Certificate Authority (CA) like Let’s Encrypt, DigiCert, or a self-signed certificate for testing.
   
2. Private Key: If your certificate is in .cer format, ensure you have the corresponding private key (often bundled in a .pfx file).
   
3. IIS Installed: IIS should already be running on your server with a website configured.

Steps to Install an SSL Certificate in IIS

Step 1: Import the SSL Certificate

1. Open IIS Manager:
   • Press Win + R, type inetmgr, and press Enter.
2. Access Server Certificates:
   • In the left-hand “Connections” pane, click on the server name (not a specific site).
   • In the center pane, double-click Server Certificates under the “IIS” section.
3. Import the Certificate:
   • In the right-hand “Actions” pane, click Import.
   • In the Import Certificate dialog:
     • Certificate File: Browse to your .pfx file (e.g., mycertificate.pfx).
     • Password: Enter the password provided by your CA when you exported the .pfx file (if applicable).
     • Select Certificate Store: Choose “Personal” (default) or “Web Hosting” if available.
   • Click OK to import the certificate.
   • The certificate should now appear in the Server Certificates list.

Note: If you have a .cer file (without a private key), you’ll need to complete the certificate request (see “Alternative Method” below).

Step 2: Bind the Certificate to Your Website

1. Select Your Website:
   • In the left-hand “Connections” pane, expand “Sites” and select the website you want to secure (e.g., “MyWebsite”).
2. Edit Bindings:
   • In the right-hand “Actions” pane, click Bindings.
3. Add or Edit HTTPS Binding:
   • In the Site Bindings window:
     • If no HTTPS binding exists: Click Add, set Type to https, and enter your Host Name (e.g., www.example.com).
     • If an HTTPS binding exists: Select it and click Edit.
   • In the “Add/Edit Site Binding” dialog:
     • IP Address: Leave as “All Unassigned” or specify your server’s IP.
     • Port: Default is 443.
     • Host Name: Enter your domain (e.g., www.example.com).
     • SSL Certificate: From the dropdown, select the certificate you just imported (it’s usually listed by its friendly name or domain).
   • Click OK, then Close.
4. Restart the Website:
   • In the right-hand “Actions” pane, click Restart under “Manage Website” to apply the changes.

Step 3: Test the SSL Configuration

• Open a browser and navigate to your site (e.g., https://www.example.com).
• Look for the padlock icon in the address bar to confirm the SSL is working.
• If there’s an error (e.g., “Certificate not trusted”), ensure the certificate matches the domain and is issued by a trusted CA.

Alternative Method: Completing a Certificate Request

If you don’t have a .pfx file yet and need to request a certificate from a CA:

1. Create a Certificate Request:
   • In IIS Manager, go to Server Certificates > Create Certificate Request (in the Actions pane).
   • Fill in the details (e.g., Common Name = www.example.com, Organization, etc.).
   • Choose a cryptographic provider (e.g., Microsoft RSA) and bit length (e.g., 2048).
   • Save the request as a .txt file (e.g., certreq.txt).
     
2. Submit to a CA:
   • Submit the .txt file to your CA (e.g., via their website) to get your certificate.
     
3. Complete the Request:
   • Once the CA provides the certificate (e.g., .cer file), return to Server Certificates > Complete Certificate Request.
   • Browse to the .cer file, provide a friendly name (e.g., “MySite SSL”), and select the “Personal” store.
   • Click OK to import it.
4. Bind the Certificate: Follow Step 2 above to bind it to your site.

Troubleshooting Tips

• Port 443: Ensure port 443 is open in your server’s firewall (e.g., Windows Defender Firewall > Inbound Rules > New Rule > Port > TCP 443).
• Certificate Mismatch: Verify the certificate’s Common Name (CN) or Subject Alternative Name (SAN) matches your domain.
• Browser Errors: If you get a “Not Secure” warning, the certificate may be self-signed or expired—use a trusted CA for production.
• Check Binding: Ensure the correct certificate is selected in the HTTPS binding.

Your SSL certificate should now be installed and working in IIS! Let me know if you run into any issues or need further clarification.