SSL Certificate Administration for IIS 8, 8.5, and 10

Introduction

This guide is divided into two sections depending on whether you are generating a CSR yourself or if you are installing a pre-bundled certificate and key (e.g. from our FairCSR service or an export from another server).

If you are generating the CSR file locally, please follow Installation from CSR.

If you already have a PFX file (e.g. from our CSR service or a backup from another server), please follow Installation from PFX file.

Installation from CSR

Installing an SSL certificate based on a CSR generated directly on the server.

1. Generating a CSR on the target server.
2. Installing a certificate ordered via CSR on the server where the CSR was created.
3. Binding the certificate to the default website to configure the site for HTTPS.
4. Binding the certificate to additional websites using SNI (Server Name Indication).

Installation from PFX file

Installing an SSL certificate from a PFX file (e.g. received via FairCSR service).

1. Installing the certificate from a PFX file (FairCSR service or export from another server).
2. Binding the certificate to the default website.
3. Binding the certificate to additional websites using SNI (Server Name Indication).

Exporting a Certificate to a PFX file

Exporting an installed SSL certificate to a PFX file for backup or migration.

1. Exporting a certificate to a PFX file for installation on another server.

Generating a CSR

1. Log on to the server with administrator privileges.

Press Windows key + R.

Type inetmgr

Click OK.

2. Under Connections on the left, select the server where you want to generate the CSR.

In the center pane, double-click Server Certificates.

3. Under Actions on the right, click Create Certificate Request.

4. Fill in the Distinguished Name properties as follows:

• Common name (CN): This is typically the Fully Qualified Domain Name (FQDN) you are securing (e.g. www.fairssl.dk).

If you are ordering a Wildcard certificate, use *.fairssl.dk.

• Organization (O): Your legal company name.
• Organizational unit (OU): Department name (can be left blank).
• Locality (L): City.
• State (ST): County or Province.
• Country (C): Two-letter country code (e.g. GB, DK, SE) in uppercase.

Click Next.

5. Specify the following:

• Cryptographic service provider: Microsoft RSA SChannel Cryptographic Provider.
• Bit Length: 2048.

Click Next.

6. Specify a path and filename to save the CSR request.

Click Finish.

Result:

The CSR is a plain text file. You can open it in a text editor like Notepad.

Copy the entire text, including the headers and footers, and paste it into the order form, or attach the file to an email.

A CSR contains no confidential information or private keys; it is safe to send via unencrypted email.

Installing a Certificate Ordered via CSR

We recommend installing the intermediate certificate first. You should have received this alongside your server certificate.

Installing the Intermediate Certificate

1. Log on to the server with administrator privileges.

2. Open a text editor like Notepad.

Copy the text of the Intermediate certificate from your delivery email (include all dashes).

Save the file as intermediate.cer on your desktop.

3. Press Windows key + R.

Type mmc.exe

Click OK.

4. Under File, click Add/Remove Snap-in.

5. Select Certificates from the list and click Add.

6. Select Computer account and click Next.

7. Select Local Computer and click Finish.

8. Expand Certificates (Local Computer).

Expand Intermediate Certification Authorities.

Right-click on Certificates.

Under All Tasks, click Import.

9. Click Browse... and navigate to your saved file.

Select the file and click Open, then Next.

10. Select Automatically select the certificate store based on the type of certificate.

Click Finish.

Note: You may need to restart services or the server for the changes to take effect across all applications.

Intermediate Certificates

If you need to download specific intermediate certificates manually, you can find them here. We always recommend using the ones provided in your delivery email as they are matched to your specific server certificate.

Intermediate Certificates from various CAs

Installing the Server Certificate

1. Log on to the server with administrator privileges.

Press Windows key + R.

Type inetmgr

Click OK.

2. Under Connections on the left, select the server.

In the center pane, double-click Server Certificates.

3. Under Actions on the right, click Complete Certificate Request.

4. Browse to your certificate file and click Open.

Enter the following:

• Friendly name: A descriptive name to identify the certificate in IIS (e.g. "fairssl.com - expires 2027"). This can be changed later.
• Select a certificate store for the new certificate: Select Personal.

Click OK to install the certificate.

The certificate is now installed, but you must still bind it to your website in IIS Manager.

Installing a Certificate from a PFX file

1. Log on to the server with administrator privileges.

Save the PFX file to an accessible location, such as the desktop.

2. Press Windows key + R.

Type mmc.exe

Click OK.

3. Under File, click Add/Remove Snap-in.

4. Select Certificates and click Add.

5. Select Computer account and click Next.

6. Select Local computer and click Finish.

7. Expand the tree until you see the Personal folder.

Right-click on Personal.

Under All Tasks, click Import.

8. Click Browse... and navigate to your PFX file.

9. Change the file extension filter to Personal Information Exchange (*.pfx;*.p12) and select your file.

Click Open and then Next.

10. Enter the password for the PFX file.

If using FairCSR service, you will have received this code via SMS when the order was initiated.

Leave the default options and click Next.

11. Select Automatically select the certificate store based on the type of certificate.

Click Next and then Finish.

Binding the Certificate to Websites

If you have multiple certificates for different sites, ensure they are all installed. Use Friendly Names to easily identify which certificate belongs to which site.

Binding a Certificate to the Default Website

1. Log on to the server with administrator privileges.

Press Windows key + R.

Type inetmgr

Click OK.

2. In IIS Manager, select the website you want to secure from the Connections pane.

Under Actions on the right, click Bindings.

3. Click Add. If an HTTPS binding already exists, select it and click Edit.

4. Configure the binding:

• Type: Select https.
• IP address: All Unassigned (default) or a specific IP.
• Port: 443.
• SSL certificate: Select your installed certificate. Use View to verify if unsure.

Click OK and then Close.

The website is now configured for HTTPS. We recommend testing the installation with our SSL Scanner: https://www.fairssl.com/en/tools/ssl-scanner

Binding Certificates to Additional Websites (SNI)

1. Log on to the server with administrator privileges.

Open IIS Manager (inetmgr).

2. Select the additional website you wish to secure.

Under Actions, click Bindings.

3. Click Add (or Edit if HTTPS exists).

4. Configure the SNI binding:

• Type: https.
• IP address: All Unassigned or specific IP.
• Port: 443.
• Host name: Enter the FQDN for this site (e.g. mail.fairssl.dk).
• SSL certificate: Select the correct certificate.
• Check Require Server Name Indication.

Click OK.

Repeat these steps for all websites. Note: If a site uses multiple names (e.g. fairssl.dk and www.fairssl.dk), you must create a binding for each name.

Your websites are now secured. Test them at: https://www.fairssl.com/en/tools/ssl-scanner

Exporting a Certificate to a PFX backup

1. Log on to the server with administrator privileges.

2. Press Windows key + R, type mmc.exe, and click OK.

3. Under File, click Add/Remove Snap-in.

4. Select Certificates, click Add, select Computer account, then Local computer, and click Finish.

5. Navigate to Certificates (Local Computer) > Personal > Certificates.

Right-click the certificate you wish to export, select All Tasks, and then Export.

8. Select Yes, export the private key. Click Next.

9. Select Personal Information Exchange - PKCS #12 (.PFX). Click Next.

10. Tick Password: and enter a strong password for the PFX file. Secure this password carefully.

Click Next.

11. Select a location and filename for the PFX file. Click Next and then Finish.