How to install a certificate in IIS

Before you start

• Windows Server with IIS 10 (IIS 8.5 or later for automatic rebind), and an administrator account.
• Your certificate with its private key: a PFX (PKCS #12) file and its password, or the CA’s response to a CSR you created on this server (create a CSR on Windows).
• The CA’s intermediate certificate, if the PFX does not contain it.
• For Let’s Encrypt, win-acme does all of this and keeps it renewed.

Why it matters: IIS refers to the certificate by thumbprint in the computer’s store, and Windows sends the chain it can build from that computer’s stores. A missing intermediate or private key is the usual cause of a broken HTTPS site on IIS.

Steps

1. Check the PFX before you import it

certutil -dump reads the file without importing anything. For our test PFX, built with OpenSSL from a throwaway test CA, Windows 11 showed:

certutil -dump -p <password> www.pfx

================ Certificate 0 ================
Issuer: CN=Example Corp Root CA, O=Example Corp, C=BE
Subject: CN=Example Corp Issuing CA 1, O=Example Corp, C=BE
No key provider information
...
================ Certificate 1 ================
Issuer: CN=Example Corp Issuing CA 1, O=Example Corp, C=BE
Subject: CN=intranet.example.com
  Provider = Microsoft Software Key Storage Provider
Encryption test passed
CertUtil: -dump command completed successfully.

You want two things: the server certificate with a private key (Encryption test passed), and the intermediate. The intermediate has no key, which is correct. If you have PEM files instead, build the PFX with OpenSSL and include the intermediate with -certfile:

openssl pkcs12 -export -out www.pfx -inkey www.key -in www.crt -certfile intermediate.crt -name "www.example.com"

Older Windows versions may not open the AES-protected PFX files OpenSSL 3 makes by default; see PFX and PEM.

2. Import it into the computer’s Personal store

In PowerShell as administrator, with Import-PfxCertificate:

$pfxPassword = Read-Host -AsSecureString -Prompt "PFX password"
Import-PfxCertificate -FilePath C:\certs\www.pfx -CertStoreLocation Cert:\LocalMachine\My -Password $pfxPassword

Without -Exportable the key cannot be exported again, which is what you want on a web server; keep the original PFX in your secrets vault instead. In IIS Manager, the same is server node > Server Certificates > Import.

If you created the CSR in IIS Manager, use Complete Certificate Request with the CA’s .cer file instead. The key is already on the server.

3. Make sure the intermediate is in place

Import-PfxCertificate puts every certificate in the PFX into the store you name: “Certificates with and without private keys in the PFX file are imported”. So after step 2 the intermediate sits in the Personal store next to your certificate. Check the computer’s Intermediate Certification Authorities store:

Get-ChildItem Cert:\LocalMachine\CA | Where-Object Subject -like '*Issuing CA*' | Format-List Subject, Thumbprint, NotAfter

If it is missing, import it there; never into Trusted Root:

Import-Certificate -FilePath C:\certs\intermediate.cer -CertStoreLocation Cert:\LocalMachine\CA

4. Add the HTTPS binding

In IIS Manager: select the site, Bindings > Add. Choose type https, IP address All Unassigned, port 443, type the Host name, tick Require Server Name Indication, and pick the certificate.

Or in PowerShell with the IISAdministration module (New-IISSiteBinding):

$cert = Get-ChildItem Cert:\LocalMachine\My |
    Where-Object { $_.HasPrivateKey -and $_.DnsNameList.Unicode -contains 'www.example.com' } |
    Sort-Object NotAfter -Descending | Select-Object -First 1

New-IISSiteBinding -Name "Default Web Site" -BindingInformation "*:443:www.example.com" `
    -CertificateThumbPrint $cert.Thumbprint -CertStoreLocation "Cert:\LocalMachine\My" `
    -Protocol https -SslFlag Sni

With SNI, several sites can share one IP address and port, each with its own certificate. Protocol versions and cipher suites are mostly set for the whole server in Windows (Schannel); the binding’s SSL flags, such as DisableLegacyTLS, adjust a few of them per site. See How to configure TLS securely.

5. Plan the renewal now

A renewed certificate has a new thumbprint, and the binding still points to the old one. Choose one of these:

• Certificate Rebind (IIS 8.5 and later): Server Certificates > Enable Automatic Rebind of Renewed Certificate. It reacts to Windows’ certificate-renewal event, so it works for renewals through Windows (manual renewal or autoenrollment), not for a new certificate you import (Microsoft).
• An ACME client such as win-acme, which imports the new certificate and updates the binding itself.
• A script that repeats steps 2 to 4, run by your deployment tooling.

Check it worked

On the server, confirm the binding and its certificate:

Get-IISSiteBinding -Name "Default Web Site"
netsh http show sslcert hostnameport=www.example.com:443

netsh shows the Certificate Hash (the thumbprint) bound to that name and port. Then test from another machine, as a client sees it:

openssl s_client -connect www.example.com:443 -servername www.example.com </dev/null 2>/dev/null | grep -E '^ [0-9] s:|^   i:|Verify return code'

You want two certificates, the server certificate first, and Verify return code: 0 (ok). Paste the -showcerts output into the chain checker:

Try it: Chain checkerOpen the full tool

Runs in your browser. Nothing you paste is sent anywhere.

Paste the chain

Try a sampleChoose a sample…A complete chain: leaf, intermediate and rootA server that forgets its intermediateA chain in the wrong orderA self-signed root CA

-----BEGIN CERTIFICATE----- MIIC1zCCAnygAwIBAgIQWTTOzqWiPshGdQhNb6kmNjAKBggqhkjOPQQDAjB+MQsw CQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8gdG8gSGVybzEnMCUGA1UECxMe U2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVkMSswKQYDVQQDEyJQS0kgWmVy byB0byBIZXJvIFNhbXBsZSBJc3N1aW5nIENBMB4XDTI2MTAwMTAwMDAwMFoXDTM2 MTAwMTAwMDAwMFowGjEYMBYGA1UEAxMPd3d3LmV4YW1wbGUuY29tMFkwEwYHKoZI zj0CAQYIKoZIzj0DAQcDQgAEw4og6Y/SOr+WrqSv+ng7tOBEsc5N3A3yZRk+9hsR XzPQvB9672aHZHTYFNlSY93RWVcTRieE+8XnIbWIYfwxIqOCAT4wggE6MAwGA1Ud EwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMCcG A1UdEQQgMB6CD3d3dy5leGFtcGxlLmNvbYILZXhhbXBsZS5jb20wHQYDVR0OBBYE FALMipe4vcXJTpwO926S15Y/bobzMB8GA1UdIwQYMBaAFN+ph37v40SN23r6Fg/z OvSNjJqeMEgGCCsGAQUFBwEBBDwwOjA4BggrBgEFBQcwAoYsaHR0cDovL3BraS5l eGFtcGxlLmNvbS9zYW1wbGUtaXNzdWluZy1jYS5jcnQwPQYDVR0fBDYwNDAyoDCg LoYsaHR0cDovL3BraS5leGFtcGxlLmNvbS9zYW1wbGUtaXNzdWluZy1jYS5jcmww EwYDVR0gBAwwCjAIBgZngQwBAgEwCgYIKoZIzj0EAwIDSQAwRgIhAM5dJUPhL+qV artvWtQinfnykhVflJTjMXe8M6PnqQfaAiEAhOLGj1hSEkNxQoMrYNXRaIe69nq6 2unibVFSVw1AC80= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIE2TCCAsGgAwIBAgIQPh9PeiGf4STnEQriHxExjDANBgkqhkiG9w0BAQsFADB7 MQswCQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8gdG8gSGVybzEnMCUGA1UE CxMeU2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVkMSgwJgYDVQQDEx9QS0kg WmVybyB0byBIZXJvIFNhbXBsZSBSb290IENBMB4XDTI1MDEwMTAwMDAwMFoXDTQw MDEwMTAwMDAwMFowfjELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEFBLSSBaZXJvIHRv IEhlcm8xJzAlBgNVBAsTHlNhbXBsZXMgLSBub3QgcHVibGljbHkgdHJ1c3RlZDEr MCkGA1UEAxMiUEtJIFplcm8gdG8gSGVybyBTYW1wbGUgSXNzdWluZyBDQTBZMBMG ByqGSM49AgEGCCqGSM49AwEHA0IABBFqObJ/j93aHrAuebO5+KWnj0xRFzUS8/Jh Idj6jR/p4zqaNT8+gOqxZ+zhpNO/weIpz/nzXjQ7RJS+EebYRNijggEfMIIBGzAS BgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggr BgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFN+ph37v40SN23r6Fg/zOvSNjJqe MB8GA1UdIwQYMBaAFIVx1Hy1TuED0pMkxEcdM+DWWPGiMEUGCCsGAQUFBwEBBDkw NzA1BggrBgEFBQcwAoYpaHR0cDovL3BraS5leGFtcGxlLmNvbS9zYW1wbGUtcm9v dC1jYS5jcnQwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL3BraS5leGFtcGxlLmNv bS9zYW1wbGUtcm9vdC1jYS5jcmwwEwYDVR0gBAwwCjAIBgZngQwBAgEwDQYJKoZI hvcNAQELBQADggIBAFa8c1kEzTTPW2aPDRPb3+OQc8GTgwpZV0pWNR3e6X8mJi7A D/RGrz4t354IwGzTts+tX23sY3fORKST3/BkqeHZwAZHvGNWi0+Co342eo2BySxo bcyy31AJBSSHOC2b7KJ11coMX++bvaHgtwOloy6DnHRDYIFwWRHg91wo1MKJGNVb OQH0vmqn6YPDLZ4BYL8VHOVtlRddBwd6bKyyp3Lw0MEMgfmg87Yd/U0yRZFaLKNb b5vgDg7n+J1ozFwvumQlN6WVEyPsQdvI73K5bgMHkUeeUQ6j9KOeDMZMjbqQSC8x 1khcyT/qhqZLDJIHvmWS11FcYaLQUuvQiAzQieTNIuOM8WJw95LlxYSNIkZeOuLf f+JboiuT1cmqmvdbngAXtBIWRJ+Byeqdq2Z0d8Xfln6gWhHmm93+DO5uTaTxBwTr DayFTdTFxBZydXs48S+I/rVQvQtwkRh3rOcZpwTMsGzfoiCsOhEaiBOFk0C5FEKi um55SDXCMR6yXDhWqFPBIdle4izj5g2YmuZ3YD4G3PlcX5okW7aKTNU3RGWEOMk3 Ob9bkPnCsY7Ei4OqDqTBt/8HH/2kA4om4RzKGLw5Zc/Y+KhpbFhT52gtL7WDEEVZ NqFHgi6fdHgsczFNpCKhC8vM+mAM/gBiVR8hYIpt5lPFyXpFJO5Wn5BcEkv3 -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIFxDCCA6ygAwIBAgIQV3/H8mpwNp5raCafwOtSezANBgkqhkiG9w0BAQsFADB7 MQswCQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8gdG8gSGVybzEnMCUGA1UE CxMeU2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVkMSgwJgYDVQQDEx9QS0kg WmVybyB0byBIZXJvIFNhbXBsZSBSb290IENBMCAXDTI1MDEwMTAwMDAwMFoYDzIw NTAwMTAxMDAwMDAwWjB7MQswCQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8g dG8gSGVybzEnMCUGA1UECxMeU2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVk MSgwJgYDVQQDEx9QS0kgWmVybyB0byBIZXJvIFNhbXBsZSBSb290IENBMIICIjAN BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAnYTGHkYMca54QPkZcZENin3BHB3t uKdHkDZeKZvJHWqpfXpcZfusLvtJFeTrwWlEDBJuV20vmhaLeV29QeYKaIkm1Ul2 qCkrLUpWn/W9CPosfVqMd1nOrd+Ka9iPSeKlW3YX1P5WqQEjieJhBzT9comdj8qN /PynceTDcLa2mgYw7QhU8trBoLzhYqIJFfoUBk+7lahae8b9G5wKCbDicRM8/ATt 0dO9jCxi6RxJpkKl24ULgNOuFP9gG4nubWA8+BaMeM0LU64wNciFofgM2g/3iHHn zmcoe1z80C7WN+GuzNkWkN8D/tcqrbua0O5fREKKw6PyyxwQsjeMghpxLb0h1KeA ihpQMVgpWbhRkkpvF5odkF9vTJP89Z2y+8cgnUMyTpXATrt8KgC5LdWo5mlTNXC/ MvbCUb1Vz9bvcEx2y29tUeLIAUmyBzhF7zgMUPAOtDbLLCuxgR78T2TWaXB/8WBT XL44Wk5rOe7U+KuBr/t12AcZjaq0AGiNsvfd1P+IFbRivElegpdrM+S3arjOjptP M9sUl9Hc+cszaTpEVcQFFxcIyvq5HVjTlZr4vLKdqlhSkQB9hZUFuWNpnUZEYEnA 1vn/GkHNTJ6pv8XxdNXkFeRaUv3ajCn7CQ3UP/EXJqzBw5fl6aa9lqKTS5kF9rgw EIhwNaSd2O557KUCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E BAMCAQYwHQYDVR0OBBYEFIVx1Hy1TuED0pMkxEcdM+DWWPGiMA0GCSqGSIb3DQEB CwUAA4ICAQBMdaOOM84aoItvumQ/sNzOhXvmLwboTb3oe67wda9TvPMSf2aP3JtP UWsR/9UbZgNE9M41p2+XZlVpsGP1BLEvi5ZwfMWmR876Mw1Zkt8ouY3DWN08egnm IdV2vKwDHhDE93IQ12fjNc8iuMCasoYiXTsmXx3R/+PkNbeBAupZEk6EwTr75PCY IJ2cheL7jQ06xeCCZv815rG+63jGk3tys7A+nUXKqOp9oN/dkEhi+YWiHG9UJ2w/ BDZCFUUoJBia7C3+hcXZAVxtWwTy0A5T/plEsqGcdfCMFA4cOFstthyS/Wnnuw8y cpSiXdUAQbLkJ+CGavr6MXVmDicmnV9p3Pv9EbpGPV8UlxwvoQMf+ajEE4EAaJkN Gc85wOC7Y7wwWkBnzjiyLztqRqOFdHEdM13V+2Gw2545Jk8o2gRizBQ6Ey6rlt2u YdYFqFFQhe2H+VqvJiLKefkN1mVQhvhfAvuoxZWIsDtyJWGs12L06xMj3wG98kne mUJjPzze3swZU39eiaC1MBs6U0oLZE6ZqubmjJd/ppmGyK+7o2SMi0juouvw6rcA J9eUJQLNpiVKmiwzKvPejASpunK5B5JO3Y7NAb4SVU22ItR73bBiRAugPwVajlBN RGcjMkDSiW07/dhN6GgjsNAzXHcTR7/nbILOAWbhBstNFK1mgejlbQ== -----END CERTIFICATE-----

Every certificate the server sends, leaf first. The output of openssl s_client -showcerts -connect example.com:443 works as it is: we ignore the text around the certificates.

Check the chainClearChoose a file

If something goes wrong

• The certificate does not appear in the IIS list, or the binding fails. It has no usable private key: Get-ChildItem Cert:\LocalMachine\My | Format-Table Subject, HasPrivateKey. Import the PFX that contains the key. If you completed a CSR made on this server, certutil -repairstore my <serial number> can re-link the certificate to its key.
• Browsers work, but curl, Java or apps report unable to verify the first certificate or unable to get local issuer certificate. The intermediate is not being sent: repeat step 3. Windows clients may fetch it themselves, which hides the problem. See build the full chain.
• A different site’s certificate is served. The binding lacks SNI or a host name, or the client sends no SNI and gets the default *:443 binding.
• NET::ERR_CERT_COMMON_NAME_INVALID. The certificate does not cover the host name. Check it with the hostname matcher.
• NET::ERR_CERT_DATE_INVALID after a renewal. The binding still points to the old certificate (step 5).
• .NET clients say The remote certificate is invalid. One of the causes above; the error page lists how to tell them apart.

Why this works

IIS uses Windows’ TLS stack, Schannel. When a client connects, Windows looks up the binding for the IP, port and SNI host name, loads the certificate and its private key from the computer store, and builds the certificate chain to send from the local stores. The key signs the TLS handshake; the client then checks the chain against its own roots. See Certificate chains and path validation, The TLS 1.3 handshake and, for renewals, Inventory, expiry and renewal.

Go deeper

• Import-PfxCertificate: importing a PFX into the computer store.
• New-IISSiteBinding: HTTPS bindings, SNI and the other SSL flags.
• Certificate Rebind in IIS 8.5: how automatic rebinding works and when it triggers.
• IIS 8.0 Server Name Indication: how SNI bindings work in IIS.