How to install or renew an SSL certificate on IIS (Windows Server)

This guide covers SSL certificates on Internet Information Services (IIS): getting one, binding it to a site, renewing it, and automating renewal. Steps use IIS Manager on Windows Server 2016 and later.

Option A: a commercial certificate

1. Create a certificate request (CSR)

1. Open IIS Manager, select the server in the left pane, and open Server Certificates.
2. In Actions, choose Create Certificate Request….
3. Enter the details: Common name is the site's address (for example www.example.com). Choose Microsoft RSA SChannel Cryptographic Provider and a bit length of 2048 or more.
4. Save the request file and send it to your certificate authority.

The private key stays on this server. Complete the request on the same server.

2. Complete the request

When the CA sends your certificate (.cer or .crt):

1. Install the CA's intermediate certificate first: open certlm.msc (Manage computer certificates), go to Intermediate Certification Authorities → Certificates, right-click All Tasks → Import, and import the intermediate file. IIS sends whatever intermediates are in this store; without it, apps and API clients can fail even though browsers work (why).
2. Back in Server Certificates, choose Complete Certificate Request…, select the file, give it a friendly name (for example example.com 2026) and choose the Web Hosting store.

If you received a .pfx file instead (certificate and key together), use Import… in Server Certificates and enter its password.

3. Bind it to the site

1. Select the site, then Bindings… in Actions.
2. Add… (or edit the existing https binding): type https, port 443, the host name (for example www.example.com), and tick Require Server Name Indication if this server hosts more than one HTTPS site.
3. Choose the certificate in SSL certificate, then OK.

The change takes effect immediately; no restart needed.

Option B: free and automatic with win-acme

win-acme is a free ACME client for Windows that gets Let's Encrypt (or other ACME) certificates, installs them in IIS, updates the bindings and creates a scheduled task to renew them.

1. Download win-acme and run wacs.exe as Administrator.
2. Choose N: Create certificate (default settings), pick the IIS site, and confirm the host names.
3. win-acme validates the domain, installs the certificate, binds it and schedules renewal.

Check the renewal task exists in Task Scheduler (it's named after win-acme), and test it with wacs.exe --renew --force.

Renewing a commercial certificate

1. Create a new request (as above) or use Renew… on the certificate in Server Certificates.
2. Complete it with the new certificate from your CA.
3. Update every https binding to use the new certificate. This is the step most often missed: IIS keeps serving the old certificate from each binding until you change it.
4. Once the site serves the new one, you can remove the old certificate from Server Certificates.

To list certificates and their expiry dates from PowerShell:

Get-ChildItem Cert:\LocalMachine\My, Cert:\LocalMachine\WebHosting -ErrorAction SilentlyContinue |
  Select-Object FriendlyName, Subject, NotAfter | Sort-Object NotAfter

TLS versions on Windows

IIS uses the TLS settings of Windows (SChannel). Windows Server 2022 and later support TLS 1.3. To turn off TLS 1.0 and 1.1 and choose cipher suites, the free IIS Crypto tool from Nartac applies Microsoft-recommended templates (a restart is needed). See Turn off TLS 1.0 and 1.1, turn on TLS 1.3.

Check the result

Run the SSL checker on your site: it shows which certificate IIS is actually serving, whether the chain is complete and which TLS versions are on.

CertHalo checks your sites on a schedule and emails you before a certificate expires, so a forgotten binding never takes a site down. Monitor 3 certificates free.