Self-service installation

Windows / IIS

Choose: IIS / modern Windows — encrypted PFX

Prefer automatic replacement? Set up automatic renewal for supported Windows / IIS configurations. These written steps and videos remain the manual-installation fallback.

Before you start

• Confirm you administer this server and can restore its current configuration.
• Check the certificate is production-issued, unexpired and covers every intended hostname.
• Check DNS points to the intended server, including any IPv6, proxy or CDN path. A certificate does not change DNS.
• Download the matching package; store it outside the web root and keep its password separately.

These steps target modern Windows IIS with Server Certificates and site Bindings available. Older Windows versions may not import the AES-protected PFX. Check your version before making changes.

Watch a recorded installation

Recorded scripted PowerShell session on an isolated demo server. Every displayed operation was executed. Silent, with English captions. Pause or use full screen to read commands. Disposable .test certificates are not publicly trusted; use your own hostnames and normal public trust in production. Passwords and MFA are supplied privately and are not shown.

Read the recorded transcript · Watch the quick slide overview

Jump to a chapter

1. 00:00 Confirm IIS and the prepared lab
2. 00:08 Back up IIS and select the PFX
3. 00:16 Import and check the private key
4. 00:24 Select the exact hostname and SNI binding
5. 00:36 Verify real HTTPS and the control site
6. 00:48 Import renewal and switch the binding
7. 01:03 Prove certificate rollback
8. 01:15 Restore renewal and finish checks

Chapters are ready when video metadata loads.

Install step by step

1. Sign in, open the issued production request and download the IIS PFX using a fresh second factor and a new package password. Keep the password separately; staging certificates are not publicly trusted.

2. Back up your existing IIS configuration and note the site's current bindings and certificate. Transfer the encrypted PFX securely to the correct server, outside its website folder.

3. Open IIS Manager, select the server, open Server Certificates and choose Import. Select the PFX and enter its password locally. Confirm the imported certificate has the expected names, expiry and fingerprint. The import must include its private key.

4. Select only the intended website and open Bindings. Add or edit its HTTPS binding on port 443 with the exact hostname and the imported certificate. On a shared IP, require Server Name Indication. Configure apex and www separately when needed; do not replace other sites' bindings.

5. Open each HTTPS hostname from another device. Check normal browser trust, the served certificate fingerprint and the intended page. A wildcard covers one subdomain level; the apex needs its own SAN. DNS caching may still direct visitors to an old server.

6. For renewal, import the replacement and update each intended binding. Keep the previous working configuration for rollback until checks pass. Remove temporary transfer copies securely, preserving your protected recovery copy. If you need hands-on help, request a separate quote.

Illustrative configuration

Use your own paths and hostnames. Preserve the rest of your existing configuration.

IIS Manager → server → Server Certificates → Import
IIS Manager → intended site → Bindings → https / 443 / exact hostname / SNI
Choose the matching certificate, then verify every hostname over HTTPS.

Verify before calling it done

• Use another device to open every intended HTTPS hostname without bypassing certificate warnings.
• Check the correct website loads and the served certificate has the expected names, expiry and SHA-256 fingerprint.
• Check apex and www independently. A wildcard does not automatically include the apex.
• Confirm unrelated sites still work. Keep rollback material protected until checks pass.

Troubleshooting

Replacing an expiring certificate? Use the renewal checklist. Need assistance? Request a separate quote.

Official references

• https://learn.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

All installation guides · Your certificates