How to Install an SSL Certificate on IIS (Windows Server)

How do I install an SSL certificate on IIS?

To install an SSL certificate on IIS, import it into the Local Computer’s Personal certificate store (with Complete Certificate Request or by importing a .pfx file), make sure the CA’s intermediate certificate is in the Intermediate Certification Authorities store, then add an https binding to your site and select the certificate. IIS has no config file for certificates; everything runs through the Windows certificate store and site bindings.

This guide is the IIS-specific part of our overview on how to install an SSL certificate. It applies to IIS 8.0 and later (Windows Server 2012 up to current releases). If you have not created a CSR (certificate signing request) yet, you can create it in IIS Manager under Server Certificates or with our CSR generator.

Item	What you need
IIS version	8.0 or newer for SNI (several certificates on one IP)
Files	.cer/.crt + intermediate, or one .pfx with key and chain
Private key	On this server (CSR made in IIS) or inside the .pfx
Access	Local Administrator
Port	443 open in Windows Firewall

Step-by-step: install SSL certificate in IIS Manager

1a. CSR created in IIS: complete the request

1. Open IIS Manager (inetmgr), click the server name, then double-click Server Certificates.
2. In the Actions pane, click Complete Certificate Request…
3. Browse to the .cer or .crt file from your CA, enter a friendly name (for example example.com 2026-10) and choose the Personal store.
4. Click OK. The certificate now appears in the list with its private key.

1b. CSR created elsewhere: import a PFX

If the CSR and key were made on another machine, combine certificate, intermediates and key into a password-protected .pfx (PKCS#12, a single file that carries the key and chain) and click Import… in Server Certificates. With OpenSSL:

openssl pkcs12 -export -out example_com.pfx -inkey example_com.key ^
  -in example_com.crt -certfile example_com.ca-bundle

Or in PowerShell on the server:

$pw = Read-Host -AsSecureString "PFX password"
Import-PfxCertificate -FilePath C:\certs\example_com.pfx `
  -CertStoreLocation Cert:\LocalMachine\My -Password $pw

2. Install the intermediate certificate

IIS sends the chain that Windows can build from its stores. Open certlm.msc, expand Intermediate Certification Authorities → Certificates, right-click, choose All Tasks → Import and select the CA bundle. A .pfx that contains the chain usually places the intermediate there automatically. Why this matters is explained in our guide to the certificate chain.

3. Add the HTTPS binding

1. In IIS Manager, select your site and click Bindings… in the Actions pane.
2. Click Add…, set Type to https, Port to 443 and enter the Host name (for example www.example.com).
3. Tick Require Server Name Indication if other HTTPS sites share this IP.
4. Select your certificate under SSL certificate and click OK.

Tip: Add the friendly name with a date. When you replace the certificate later, you can tell the old and new one apart in the binding drop-down at a glance.

Bind the certificate with PowerShell

On Server Core or in deployment scripts, use the WebAdministration module. Replace the thumbprint with the one of your certificate (Get-ChildItem Cert:\LocalMachine\My lists them):

Import-Module WebAdministration
New-WebBinding -Name "Default Web Site" -Protocol https -Port 443 `
  -HostHeader "www.example.com" -SslFlags 1
$binding = Get-WebBinding -Name "Default Web Site" -Protocol https `
  -HostHeader "www.example.com"
$binding.AddSslCertificate("THUMBPRINT", "My")

-SslFlags 1 turns on SNI for this binding. A wildcard SSL certificate on IIS works the same way: one import, then one binding per host name that uses it.

Where does IIS store SSL certificate files?

IIS does not read certificate files from disk. It uses the Windows certificate store on the Local Computer, and each site binding references a certificate by its thumbprint. The private key is held by Windows and should only leave the server as a password-protected .pfx export.

What	Location	Open with
Server certificates	Local Computer → Personal (Cert:\LocalMachine\My)	certlm.msc, IIS Manager
Alternative store (IIS 8+)	Local Computer → Web Hosting	certlm.msc
Intermediates	Local Computer → Intermediate Certification Authorities	certlm.msc
Bindings (site ↔ certificate)	HTTP.sys SSL configuration	netsh http show sslcert
Web farms	Centralized Certificate Store (shared folder of .pfx files)	IIS Manager → Centralized Certificates

To move a certificate to another server, export it from certlm.msc with the private key as a .pfx. For Apache, Nginx, Java keystores and macOS, see where certificates are stored on other systems.

How do I host several SSL sites on one IIS server?

Give each site its own https binding with a host name and tick Require Server Name Indication. With SNI (Server Name Indication, the hostname the browser sends at the start of the TLS handshake), IIS 8.0 and later pick the right certificate per host name, so all sites can share one IP address on port 443.

A binding without SNI on *:443 or a specific IP acts as the fallback for clients that send no host name. In a web farm, the Centralized Certificate Store matches host names to .pfx file names (for example www.example.com.pfx, or _.example.com.pfx for a wildcard), so you do not have to import certificates on every server.

Tip: IIS 6 (Windows Server 2003) and IIS 7/7.5 (Windows Server 2008/2008 R2) do not support SNI and are past Microsoft’s end of support. If you still run them, one IP and port can carry only one certificate. Migrating to a supported Windows Server is the real fix.

How do I renew an SSL certificate in IIS?

Import the renewed certificate, then edit each binding and select it. IIS keeps using the old certificate until you change the binding, and the change takes effect immediately without an IIS restart. As of October 2026, publicly trusted TLS certificates last at most 200 days, falling to 100 days on 15 March 2027 under CA/Browser Forum ballot SC-081, so plan for regular swaps. When and how to renew an SSL certificate in time is covered in a separate guide.

Common IIS SSL errors

Error or symptom	Likely cause	Fix
Certificate disappears after Complete Certificate Request	Private key not on this server	Complete on the server that made the CSR, or import a .pfx
Certificate missing in the binding drop-down	No private key, or wrong store	Check for the key icon in certlm.msc; re-import as .pfx
“A specified logon session does not exist”	Key not imported as exportable/persisted	Re-import the .pfx into the Local Computer store
Works on desktop, fails on mobile	Intermediate missing	Import the CA bundle into Intermediate Certification Authorities
Wrong certificate on one site	SNI not set, or host name mismatch	Add the host name and tick Require Server Name Indication

After every change, test the live site with our SSL checker. It shows the certificate IIS actually serves, the chain and the expiry date.