Install an SSL Certificate in IIS
In IIS Manager, open Server Certificates and click Complete Certificate Request with the .cer your CA issued, choosing the Web Hosting store. Then open the site bindings, add https on port 443, tick Require Server Name Indication, and pick the certificate. It worked when the site loads over HTTPS with the full chain.
For Windows administrators binding HTTPS on IIS 8 to IIS 10.
knowledge
- Read time
- 4 min
- Sections
- 8
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 15 November 2026.
What IIS needs before a certificate can bind
IIS serves HTTPS when three things line up: a certificate that still carries its private key, a site binding on port 443, and IIS 8 or later if several sites share one IP. A dedicated IP address is not required once Server Name Indication is switched on.
- SNI support: IIS 8 and later (Windows Server 2012+) let many certificates share one address through the "Require Server Name Indication" checkbox
- Private key: created with the CSR; a certificate completed on another server has no key and will not bind
- Intermediate certificate: must be installed too, or Android and older Windows clients show a warning
- Port 443: open in Windows Firewall and in the provider firewall, if there is one
Import a PFX when the certificate was issued elsewhere
A PFX file holds the certificate, its chain and the private key, so importing it skips the pending-request step entirely. Use this path when the certificate was bought on another machine or the server was rebuilt.
- Copy the .pfx file to the server.
- Open IIS Manager with
inetmgr, click the server name, then double-click Server Certificates. - In the Actions pane click Import, choose the .pfx file, type the password from the issuer, and select the Web Hosting store.
- Refresh the list; the certificate should appear with its subject name and expiry date.
From an elevated prompt, certutil -importPFX -p PASSWORD path\to\cert.pfx does the same job when IIS Manager is not available.
Complete the pending request with the CA file
If the CSR was generated on this server, the private key is already waiting in the store, and completing the request attaches the issued certificate to it. This is the standard path in Microsoft's own SSL walkthrough: Server Certificates feature, then the site's Bindings editor.
- Save the .cer file the certificate authority sent; Base-64 encoded X.509 is the format IIS expects.
- In IIS Manager open Server Certificates, then click Complete Certificate Request in the Actions pane.
- Browse to the .cer file, type a friendly name such as the domain and year, and choose Web Hosting as the store.
- Click OK; the certificate now appears in the Server Certificates list.
A friendly name is only a label, but it is the only way to tell five certificates for the same domain apart when one is renewed early.
Bind HTTPS with SNI on port 443
The binding is what actually turns HTTPS on; a certificate sitting in the store does nothing until a site points at it. In the site's Edit Bindings dialog, add the https binding and pick the certificate from the SSL certificate dropdown.
- Expand Sites, right-click the site, and choose Edit Bindings.
- Click Add, set Type to https, IP address to All Unassigned, and Port to 443.
- Type the host name, for example www.example.com, and tick Require Server Name Indication.
- Pick the certificate in the SSL certificate dropdown, click OK, then Close.
Reuse the same pattern for every extra host: one https binding per host name, each with SNI ticked and its own certificate. Without the host name, IIS serves the first certificate on the IP to every visitor.
Verify the certificate and the chain
You know it worked when https://www.example.com loads with a padlock, the certificate shows the right common name, and the chain lists the intermediate above the leaf. Microsoft stores the SSL binding in HTTP.sys as well as in the site config, so check both layers when something looks wrong.
- Open the site in a private window, click the padlock, then Certificate, then the Certification Path tab.
- Run
netsh http show sslcertand match the host name and port 443 entry to the certificate hash in IIS Manager. - In PowerShell run
Get-ChildItem Cert:\LocalMachine\WebHosting | Format-Table Subject,NotAfter,HasPrivateKey. - Check NotAfter; a certificate that expires in days is a renewal problem, not a binding problem.
If the padlock shows an exclamation mark, the leaf is fine and the chain is not: import the issuer's intermediate into Intermediate Certification Authorities and reload. If the browser still blocks the page, work through the "not secure" warning checklist instead of rebinding.
Get a free certificate on IIS with win-acme
Let's Encrypt certificates are free, valid for 90 days, and on IIS a client does the request, the binding and the renewal task for you. win-acme is the common choice for Windows Server.
- Download the win-acme release, extract it, and run wacs.exe as administrator.
- Choose the option that scans IIS sites, then pick the site from the list.
- Accept the host name, let it create or reuse the web.config validation path, and confirm the binding.
- Finish the wizard; a scheduled task now renews the certificate and rebinds the site automatically.
Free certificates are domain-validated only. A business that needs its organisation name in the certificate has to buy an OV or EV product from the paid SSL certificate range; the differences are explained in our guide to the types of SSL certificates.
Fix the errors that stop the binding
Five errors account for most failed HTTPS setups in IIS, and each has a one-line fix. Match the message first, change one thing, and reload the site.
| Error | Cause | Fix |
|---|---|---|
| The certificate cannot be used for this purpose | No private key attached | Import the PFX, or complete the request on the server that made the CSR |
| Certificate missing from the bindings dropdown | Stored in Personal instead of Web Hosting | Re-import and pick Web Hosting, then refresh |
| HTTPS loads the wrong site | Binding has no host name or SNI | Edit the binding, add the host, tick SNI |
| Chain warning on phones only | Intermediate not installed | Import the intermediate into Intermediate Certification Authorities |
| Connection times out on 443 | Firewall rule missing | Allow inbound TCP 443 in Windows Firewall |
When to email WebJi® about a Windows certificate
Email support@webji.services with the exact IIS message, the certificate subject line, and the site binding you changed. IIS ships with Windows Server, so the server and the certificate usually arrive together on Windows hosting; the same certificate work applies on a Windows VPS you manage yourself. Support is 24/7 by email in Hindi and English, with a published average first reply under 60 minutes. The office phone is business hours only and is not a support line.
Frequently asked questions
Why does IIS say the certificate cannot be used for this purpose?
The certificate has no private key. That happens when a .cer is imported on a server that did not create the CSR, or when the CSR was regenerated. Import the PFX or reissue the certificate.
Do I need a dedicated IP address for SSL in IIS?
No, not on IIS 8 or later. Tick Require Server Name Indication and set the host name, and several certificates can share one IP address on port 443.
Where does the intermediate certificate go in IIS?
Into Intermediate Certification Authorities in the local computer store, or inside the PFX before import. Without it the leaf looks valid on desktop browsers and broken on Android.
Can I install a free SSL certificate on IIS?
Yes. win-acme requests a Let's Encrypt certificate, creates the HTTPS binding and schedules renewal. The certificate lasts 90 days and renews through a Windows scheduled task.
How do I check which certificate a site is really using?
Run netsh http show sslcert and match the host name and port 443 entry to the thumbprint in IIS Manager. The browser padlock shows the certificate the client received, which can differ from the binding.
Last editorial update: 15 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.