How to Add an SSL Certificate in IIS

A man holding a small brass padlock up to the light beside an open laptop at a bright desk

Short answer: Get a certificate for your domain, import it under Server Certificates in IIS Manager, then add a binding on port 443 with type https and that certificate selected. Finally, redirect HTTP to HTTPS so visitors always land on the secure version.

Applies to: Infosaic VPS · Windows Server · IIS

Browsers now label plain HTTP sites as not secure, and visitors act on that label. HTTPS is no longer a refinement for sites that take payments — it is the baseline for anything with a domain name.

The mechanics in IIS are straightforward. The confusing part is usually the certificate file formats, so that is covered first.

Getting a certificate

A man at a two-monitor desk building a website

You need a certificate issued for your exact domain name by a certificate authority browsers trust. Where it comes from is up to you — a commercial authority, or a free automated one.

What you will end up with is one of two things:

A .pfx file (sometimes .p12) with a password. This is what IIS wants, and it contains the certificate and the private key together. If you are offered this format, take it.
Separate .crt and .key files, common from Linux-oriented providers. These need converting to .pfx before IIS can use them — OpenSSL does it in one command, or your provider may offer a conversion tool.

The alternative route is a CSR: generate a Certificate Signing Request in IIS Manager under Server Certificates, send it to your authority, and use Complete Certificate Request when they send the certificate back. That keeps the private key on the server the whole time, which is tidier.

How to install it in IIS

Copy the .pfx onto the VPS.
Open IIS Manager and select the server name at the top of the tree — not the site.
Double-click Server Certificates.
Click Import on the right, browse to the .pfx, enter its password and click OK. The certificate appears in the list.
Now select your site in the tree and click Bindings.
Click Add. Type https, port 443, host name your domain, and choose your certificate in the SSL certificate dropdown.
If you host more than one site on the server, tick Require Server Name Indication. That is what allows several HTTPS sites to share one IP address.
Click OK, then visit https:// your domain and check for the padlock.

Add a binding for www as well if your certificate covers it — and most do, because visitors type both.

Send everyone to the secure version

A man at a studio desk with a laptop and a small network switch with green lights

HTTPS working is not the same as HTTPS being used. Until you redirect, anyone typing the domain without the prefix still gets the insecure version.

The usual approach is the URL Rewrite module for IIS: install it, then add a rule redirecting any request that is not already HTTPS to the HTTPS equivalent, with a permanent redirect.

Then test properly — the bare domain, the www version, and a deep page — and check the padlock appears on all of them. A page that loads one image over plain HTTP will show a broken padlock instead of a clean one.

Put the expiry date in your calendar the day you install it. Certificates expire, and an expired certificate makes a site look broken and untrustworthy to every visitor at once. Set a reminder three weeks before, or use an automated issuer that renews for you.

If it does not work

The page will not load at all on 443 — the Windows Firewall is probably blocking the port. Allow inbound 443.
Name mismatch warning — the certificate was issued for a different name than the one being visited. Check www versus the bare domain.
The certificate is not in the dropdown — it was imported without its private key. Re-import from the .pfx.
Untrusted or incomplete chain — an intermediate certificate is missing. Install the bundle your authority supplied.
Broken padlock — the page loads an image, script or stylesheet over plain HTTP. Fix those links.
The wrong site answers on HTTPS — enable Server Name Indication on the bindings.

Questions and answers

How do I install an SSL certificate in IIS?

Import the .pfx under Server Certificates at the server level, then add an https binding on port 443 for your site with that certificate selected.

What file format does IIS need?

A .pfx file containing both the certificate and its private key. Separate .crt and .key files must be converted to .pfx first.

Can I host several HTTPS sites on one IP address?

Yes. Tick Require Server Name Indication on each binding, and modern browsers will reach the right site.

Why is my certificate missing from the dropdown?

It was imported without its private key. Import again from the original .pfx rather than from a certificate-only file.

How do I force visitors to HTTPS?

Install the URL Rewrite module and add a rule that permanently redirects any non-HTTPS request to the HTTPS equivalent.

Why does the padlock look broken?

The page is loading an image, script or stylesheet over plain HTTP. Change those references to HTTPS or protocol-relative URLs.

What happens when the certificate expires?

Browsers show a full-page warning and most visitors leave. Set a calendar reminder three weeks ahead, or use an issuer that renews automatically.

Do I need a separate certificate for www?

Most certificates cover both the bare domain and www. Check yours, and add a binding for each name it covers.

Still stuck?

Open a support request from your control panel with the domain name and the exact browser warning — that is the fastest route, because it reaches the team who can already see your server. You can also email [email protected].