Installing a TLS certificate on IIS 10 and IIS 8

In this guide, you will learn how to complete the TLS certificate request and how to install the TLS certificate on the IIS 10 and IIS 8 Web server.

IIS 8 is part of Microsoft Windows Server 2012, which brings hundreds of new features and enhancements to virtualization, networking, storage, user experience, cloud computing, automation, and more.

IIS 10 is part of the latest version of Microsoft Windows Server 2016, which has brought support for the revolutionary HTTP/2 protocol.

Creating a CSR request on IIS 10 and IIS 8

On a web server running IIS 7, the CSR is generated in a Wizard. In IIS, go to the Server certificates menu and select Create certificate request in the top right. You will see a wizard to create the CSR. Enter all the required information, select the key depth of 2048 (bits) and save the file with the generated CSR.

The generated CSR is in text form, so you can open the file created in IIS in the Notepad application and insert the CSR text into the order in SSLmarket.

You can find a video on how to generate a CSR request on the Microsoft IIS platform in the video guides section. You can use the tutorial for any version of IIS newer than 6 (IIS 7, 8 and 10).

Installing a TLS certificate on IIS 10 a IIS 8

Find Server Certificates in the IIS menu and open it. You will see a list of certificates which are on the server. In the Actions menu on the top right, click Complete Certificate Request… and select the TXT file with the certificate you received from us via email.

This dialogue box also includes the Friendly name option, which is your certificate naming that distinguishes it from others. Select Web Hosting as the certificate store.

After confirming and closing this dialogue box, the certificate is installed and you will see it in the list of certificates in the IIS.

If the certificate disappears, you are missing a matching private key on the server. In this case, you need to make a new application (CSR) and make a free reissue. You will find this option in the detail of the certificate order in your administration.

If you are importing the PFX file and see the error A specified logon session does not exist. It may already have been terminated. (Exception from HRESULT: 0x80070520), you did not check the import of the private key when importing the PFX. The solution is to delete the certificate via MMC and re-import it.

After the certificate import, go to the website detail and click Bindings in the top right. Then select the appropriate certificate for the website in the dialog box you will see. Click Add, then select HTTPS, the correct IP address, port, and finally choose the correct TLS certificate from the list.

Video tutorial to install a TLS certificate on IIS 10 and IIS 8 server

You can use this video to install a TLS certificate on a server and setting Bindings to the appropriate domain. It is created on IIS 7, but the procedure is the same except for specifics (SNI) in newer versions of IIS.

Configure multiple certificates on a server using a single IP with SNI

Use the Server Name Indication (SNI) extension if you need to use multiple TLS certificates on the server. Thanks to SNI, you do not have to set a separate IP address for each certificate, as you had to in the past. To turn on SNI, repeat the above procedure to import another certificate, and you will see the option to select Require Server Name Indication in the Bindings setting for the second certificate. You can then use multiple TLS certificates on one IP address.

DigiCert Certificate Utility for Windows

For certificate management in Windows and Windows Server environment (creation of CSR, import of issued certificate) we recommend the DigiCert Certificate Utility for Windows. You can handle any task with it (CSR, import, export) and you can also use it to manage Code Signing certificates.

Are you lost?

Write us
info@sslmarket.co.uk
Contact form

Has this article been useful?

Help

SSLmarket App