How to Manage, Renew, and Install SSL Certificates on Windows Server IIS

Managing SSL/TLS certificates across IIS (Internet Information Services) environments is one of those administrative tasks that feels simple—until an expired certificate unexpectedly brings down an internal web application or triggers browser security warnings for customer-facing web services. With major web browsers continually pushing for shorter certificate lifespans, system administrators must maintain clear procedures for requesting, renewing, installing, and troubleshooting web security certificates on Windows Server.

This guide walks through the end-to-end lifecycle of managing certificates in Internet Information Services, covering Certificate Signing Requests (CSR), commercial Certificate Authority (CA) installations such as GoDaddy, internal testing with self-signed certs, and binding management.

Pro Tip: Don't forget to bookmark this page in your browser (press Ctrl + D or Cmd + D) for quick reference during emergency certificate rotations and annual renewal cycles!

1. Generating a Certificate Signing Request (CSR) in IIS

To acquire a public SSL certificate from commercial providers like GoDaddy, Digicert, or Sectigo, you must first generate a CSR on the target IIS server. The CSR contains your public key and organizational details which the CA signs.

Step-by-Step CSR Creation:

1. Open Internet Information Services (IIS) Manager (run inetmgr).
2. In the left-hand Connections pane, select your top-level Server Name.
3. In the center pane, double-click on Server Certificates.
4. In the right-hand Actions menu, click Create Certificate Request...
5. Complete the Distinguished Name Properties field:
   • Common Name: The exact Fully Qualified Domain Name (FQDN) (e.g., portal.yourcompany.com).
   • Organization / Organizational Unit: Your legal company name and department.
   • City/Locality, State, Country: Standard geographic details.
6. Select Microsoft RSA SChannel Cryptographic Provider and a bit length of at least 2048 (4090 is recommended for enhanced security).
7. Specify a destination path for your text file (e.g., C:\Certificates\CSR_2026.txt) and finish the wizard.

2. Installing Public SSL Certificates (GoDaddy & Third-Party CAs)

Once your CA issues the certificate, you will typically receive a .crt or .p7b file along with an Intermediate Bundle. For comprehensive technical requirements on trust chains, check out Microsoft's IIS SSL/TLS Overview.

Completing the Certificate Request in IIS:

1. Return to IIS Manager > Server Certificates.
2. Click Complete Certificate Request... in the Actions pane.
3. Browse to your CA-provided file, specify a friendly name (e.g., GoDaddy Web Cert 2026-2027), and select Web Hosting as the certificate store.
4. Click OK to import the certificate into the Windows certificate store.

Binding the Certificate to Your Web Site:

Importing the certificate is only half the battle; you must explicitely bind it to HTTPS protocol listeners:

1. In IIS Manager, expand Sites and click your target website.
2. Click Bindings... in the right-hand pane.
3. Select https and click Edit (or click Add... if HTTPS isn't bound yet).
4. Select your newly imported certificate from the SSL certificate drop-down box.
5. Ensure Require Server Name Indication (SNI) is checked if host multiple SSL sites on a single IP address.
6. Click OK, then close the Bindings window.

3. Generating Self-Signed Certificates for Lab & Internal Staging

For internal applications or isolated testing environments, purchasing commercial certificates is often unnecessary. PowerShell makes generating custom self-signed certificates effortless.

Run the following command in an elevated PowerShell prompt to create a self-signed certificate placed directly into your local machine store:

New-SelfSignedCertificate -DnsName "testapp.local", "localhost" `
  -CertStoreLocation "cert:\LocalMachine\My" `
  -NotAfter (Get-Date).AddYears(1) `
  -FriendlyName "IIS Development Test Cert"

You can also create self-signed certificates directly inside IIS Manager by selecting Create Self-Signed Certificate... under the Server Certificates action menu. Remember that client machines will throw a browser warning unless the public key is trusted via Local Machine Trusted Root Certification Authorities store or distributed via Active Directory Group Policy (GPO).

4. Certificate Renewal Workflows & Best Practices

Renewing an existing certificate in IIS follows two general workflows depending on how your CA processes renewals:

Exporting & Importing PFX Files across Web Farms

If you manage multiple web servers behind a load balancer, export the certificate as a .pfx file containing the private key:

# Exporting via PowerShell
$cert = Get-ChildItem -Path Cert:\LocalMachine\My\THUMBPRINT_HERE
$password = ConvertTo-SecureString -String "YourStrongPassword123!" -Force -AsPlainText
Export-PfxCertificate -Cert $cert -FilePath "C:\Certs\ExportedCert.pfx" -Password $password

To explore modern automated renewal methods, refer to the Let's Encrypt Documentation on ACME clients like win-acme for Windows IIS environments.

5. Common IIS SSL Troubleshooting Scenarios

• Private Key Missing: If a certificate appears in MMC but cannot be selected in IIS, the private key link may be broken. Run certutil -repairstore my "THUMBPRINT" to re-associate it.
• Untrusted Root/Intermediate Errors: Ensure intermediate CA certificates are installed in the Intermediate Certification Authorities store on Windows Server.
• Port 443 Conflicts: Check for port conflicts using netstat -ano | findstr :443 if IIS fails to start site bindings.