Technical Guides
Installation and management of SSL certificates on popular platforms.
Popular guides
Get started quickly with the most common platforms.
Exchange 2016/2019: SSL Certificate Installation Guide
A comprehensive guide to SSL management on Exchange 2016/2019: covering DNS planning, Split-DNS configuration, service URL updates, CSR generation, certificate installation, and service assignment.
Exchange Server: Automating SSL/TLS Certificates with simple-acme
How to automate SSL/TLS certificate renewal on Exchange Server using the simple-acme ACME client. Covers Exchange 2013, 2016, 2019, and Subscription Edition.
Exchange: PFX export
Export an SSL certificate from Exchange Server to a PFX backup file using PowerShell or the Exchange Admin Center.
Exchange: PFX Certificate Import
Import an SSL/TLS certificate from a PFX backup file to Exchange Server using PowerShell or the Exchange Admin Center (EAC).
ACME automation by platform
Step-by-step setup of FairSSL ACME against specific appliances and server roles.
Appliances overview
Native ACME vs proxy approach. Entry point to all appliance guides.
FortiGate (7.6.3+ and legacy)
Native ACME on FortiOS 7.6.3+ or proxy for older versions and FortiMail/FortiWeb.
Cisco ASA & appliances without EAB
Single-use enrollment URL for devices that take an ACME URL but have no EAB Key ID / HMAC fields.
Citrix NetScaler / ADC
simple-acme + NITRO API. SSL cert-key bundle on 14.1+ or classic cert-key on older.
F5 BIG-IP
Built-in ACME from BIG-IP 21.1.0. Use Lego and iControl REST on older versions. FairSSL handles domain validation with AutoDNS.
KEMP LoadMaster
Proxy approach that works around KEMP's hard-coded Let's Encrypt binding via FairSSL AutoDNS.
Kubernetes (cert-manager)
ClusterIssuer with EAB and ARI renewal. Native ACME inside the cluster.
PRTG Network Monitor
simple-acme + ImportPRTG.ps1. PEM files + automatic Core Service restart.
Exchange Server
simple-acme + ImportExchange.v3.ps1. OWA, EWS, SMTP, IMAP and POP in one go.
Dynamics NAV / Business Central
IIS + Service Tier updated together. Only changed instances are restarted.
macOS (Lego + LaunchDaemon)
Intel and Apple Silicon. Customisable sync script for any service.
Windows Server
IIS, Exchange, ADFS, SBS and other Windows services
Exchange 2016/2019: SSL Certificate Installation Guide
A comprehensive guide to SSL management on Exchange 2016/2019: covering DNS planning, Split-DNS configuration, service URL updates, CSR generation, certificate installation, and service assignment.
Exchange Server: Automating SSL/TLS Certificates with simple-acme
How to automate SSL/TLS certificate renewal on Exchange Server using the simple-acme ACME client. Covers Exchange 2013, 2016, 2019, and Subscription Edition.
Exchange: PFX export
Export an SSL certificate from Exchange Server to a PFX backup file using PowerShell or the Exchange Admin Center.
Exchange: PFX Certificate Import
Import an SSL/TLS certificate from a PFX backup file to Exchange Server using PowerShell or the Exchange Admin Center (EAC).
SSL Certificate Administration for IIS 8, 8.5, and 10
A technical guide to managing SSL certificates on modern IIS versions (Windows Server 2012, 2016, 2019, and 2022), covering CSR generation, SNI configuration, and PFX management.
IIS 8, 8.5 & 10: SSL Certificate Installation
Step-by-step guide to installing an SSL certificate on Microsoft IIS 8 through 10 using the 'Complete Certificate Request' wizard and configuring HTTPS bindings. Covers Windows Server 2012 to 2025.
IIS 8–10: PFX Certificate Import
How to import an SSL certificate from a PFX file (PKCS#12) into IIS 8, 8.5, and 10 using MMC or certlm.msc. Covers Windows Server 2012 through 2025.
IIS 8-10: PFX Export
Learn how to export an SSL/TLS certificate from IIS 8, 8.5, and 10 to a PFX backup file using MMC, certlm.msc, or PowerShell. Covers Windows Server 2012 to 2025.
IIS Crypto: TLS configuration for Windows Server
Configure TLS protocols, cipher suites and security settings on Windows Server with IIS Crypto, a free tool from Nartac Software.
Importing PFX certificates on Windows
Learn how to import an SSL/TLS certificate from a PFX/PKCS12 file into Windows Server using certlm.msc, MMC, or PowerShell.
PFX Export (Windows)
Export an SSL certificate to a PFX/PKCS12 backup file from Windows Server using certlm.msc, MMC, or PowerShell.
ADFS and WAP SSL Administration
A technical guide for configuring SSL/TLS certificates for Active Directory Federation Services (ADFS) and Web Application Proxy (WAP) using PowerShell.
hMailServer SSL Administration
Installing an SSL certificate in the hMailServer mail server on Windows.
PRTG SSL Administration
Installing an SSL certificate in PRTG Network Monitor.
Installing Intermediate Certificates
A guide on installing intermediate certificates (CA bundles) on Windows Server and Linux to ensure a complete and trusted certificate chain.
Cross-signed intermediate on Windows Server
Add, force, remove and distribute cross-signed intermediates on Windows Server. Worked examples from GlobalSign, AlphaSSL, Sectigo PositiveSSL and DigiCert.
Sectigo cross-sign on Windows Server
Install the Sectigo R36 intermediate and the R46 cross-sign certificate on Windows Server, quarantine the new root and restart IIS, Exchange, RD Gateway, AD FS, SQL Server and NPS. PositiveSSL, EssentialSSL, InstantSSL and Sectigo EV.
GlobalSign and AlphaSSL cross-sign on Windows Server
Install the GlobalSign GCC R46 intermediate and the r3r46cross2019.crt cross-sign on Windows Server, quarantine GlobalSign Root R46 and restart IIS, Exchange, RD Gateway, AD FS, SQL Server and NPS. AlphaSSL, DomainSSL, OrganizationSSL and ExtendedSSL.
DigiCert G5 cross-sign on Windows Server
Install the DigiCert G5 intermediate and the cross-sign towards DigiCert Global Root G2 on Windows Server, quarantine the G5 root and restart IIS, Exchange, RD Gateway, AD FS, SQL Server and NPS. DigiCert, Thawte, RapidSSL and GeoTrust.
KeyStore Explorer: A GUI for Java KeyStore and PFX Files
Use KeyStore Explorer as a graphical alternative to the Java keytool command line. Open PFX files, convert to JKS, and manage Java KeyStores without using the terminal.
Linux
Apache, Nginx, Tomcat and other web servers
Nginx SSL/TLS Configuration Guide
A comprehensive guide to configuring SSL/TLS certificates in Nginx on Linux, including OCSP stapling, secure cipher suites, and HTTP to HTTPS redirection.
Apache SSL/TLS Administration
A technical guide for configuring and managing SSL/TLS certificates in Apache HTTP Server on Linux distributions.
Tomcat SSL Administration on Windows
A comprehensive guide to SSL/TLS configuration in Apache Tomcat on Windows using Java Keystore (JKS) and PKCS12.
HAProxy SSL Administration
Installing and configuring an SSL certificate in the HAProxy load balancer.
Lighttpd SSL Administration
Installing and configuring an SSL certificate in the Lighttpd web server on Linux.
Webmin SSL Administration
Installing an SSL certificate through the Webmin control panel on Linux.
Plesk SSL Administration
Installing an SSL certificate through the Plesk control panel.
Simply.com SSL Administration
Installing an SSL certificate on Simply.com hosting.
Appliances / NAS
Synology, QNAP and other network devices
Synology NAS SSL Certificate Administration
Install and configure an SSL certificate on your Synology DiskStation NAS using the DSM control panel.
QNAP SSL Administration
Installing an SSL certificate on QNAP NAS devices.
Cisco ASA SSL Administration
Installing and configuring an SSL certificate on a Cisco ASA firewall with ASDM.
SonicWall SSL Administration
Installing and configuring an SSL certificate on a SonicWall firewall.
sslbrain ACME Proxy: Certificates without direct internet access
Use the built-in ACME proxy in sslbrain to fetch certificates from servers without direct internet access.
Code Signing
HSM key storage, Azure Key Vault, Google Cloud KMS and Office macro signing
Signing Office Macros (VBA)
Sign VBA projects in Excel, Word and PowerPoint with a Code Signing certificate. Covers OfficeSIPs, 32-bit requirements and triple signing.
Azure Key Vault: Code Signing Setup
Complete guide to setting up Azure Key Vault Premium for Code Signing. CSR generation, certificate installation and signing with AzureSignTool.
Google Cloud KMS: Code Signing Setup
Set up Google Cloud KMS for Code Signing. HSM keys, CSR generation via PKCS#11/OpenSSL and signing with Jsign.
AWS KMS / CloudHSM: Code Signing Setup
Set up AWS KMS or CloudHSM for Code Signing. BYOK import, CSR generation and signing with Jsign.
GlobalSign Code Signing with USB token
Setting up a GlobalSign Code Signing certificate on a SafeNet USB token: drivers, token initialisation, certificate collection and signing.
DigiCert Code Signing on a USB token
Installing a DigiCert Code Signing certificate on a SafeNet USB token using the installation code from FairSSL: drivers, DigiCert Hardware Certificate Installer, initialisation and signing.
Create a CSR for Code Signing in Azure Key Vault Premium
Step by step for whoever creates the CSR: 4096 bit RSA-HSM key, the correct fields in Azure, and when the CSR is submitted with DigiCert and GlobalSign.
Other
Email certificates and other systems
Mozilla SSL Configuration Generator
Use Mozilla's SSL Configuration Generator for a secure server configuration.
CSR Generation (All Platforms)
A comprehensive guide on creating a Certificate Signing Request (CSR) for SSL/TLS certificate procurement, featuring step-by-step examples for Windows, Linux, and macOS.
S/MIME Certificate Installation – Microsoft Outlook (Windows)
Step-by-step technical guide for installing and configuring S/MIME email certificates in Microsoft Outlook on Windows for secure digital signing and encryption.
S/MIME Certificate Setup – Mozilla Thunderbird
Step-by-step guide for installing an S/MIME email certificate in Mozilla Thunderbird for digital signing and message encryption.
S/MIME Installation for Apple Mail (macOS & iOS)
A step-by-step guide to installing S/MIME email certificates in Apple Mail on macOS and iOS for digital signing and encryption.
DNS validation of SSL certificates
How to validate domain ownership with a DNS TXT or CNAME record for DV certificates.
CAA record setup
Control which Certificate Authorities may issue certificates for your domain with DNS CAA records. Includes examples for common DNS providers.
Updating Company Contact Details in the Danish CVR Register
How to update your official company information with the Danish Business Authority to facilitate OV and EV certificate validation.
Troubleshooting Certificate Chain Errors
Diagnose and resolve 'untrusted certificate' warnings by verifying and repairing your SSL/TLS certificate chain.
Legacy Guides
Products that no longer receive updates.
Ready to create a free account?
Create a free account and order your first certificate. A DV certificate is issued in under 2 minutes.