This article was created with the assistance of AI tools for research and drafting. It was reviewed, edited, and fact-checked by our human editorial team before publication.

IIS 10: Creating a Certificate Signing Request and Installing SSL Certificates

This chapter contains instructions on how to use IIS 10 (Internet Information Services Manager) to create your CSR (Certificate Signing Request) and then install your SSL certificate on your Windows Server 2016. It is divided into the following sections:

Tip

If you are looking for an easier way to create a CA signing request and to install your SSL certificates, we would recommend using DigiCert® Certificate Utility for Windows. You can use the DigiCert® Certificate Utility to create your certificate signing request and install your SSL certificate.

For more information, see: DigiCert Utility | Windows Server 2016 | Create a CSR & Install SSL Certificate.
General information on SSL certificates can be found here: What is an SSL Certificate?
Please note that clicking on these web addresses will take you away from TRASER DOCS. TRASER Software GmbH is not responsible for the content on these websites.

Creating a Certificate Signing Request with IIS 10 on Windows Server 2016

This section describes how to create your certificate signing request using IIS 10. To do so, proceed as follows:

  • Open the Internet Information Services (IIS) Manager from the Windows start menu.
  • In the Internet Information Services (IIS) Manager, click the server name in the menu structure under Connections (left).
  • On the server name home page (center pane) in the IIS Manager, double-click Server Certificates.
  • On the Server Certificates page in the Actions menu (right pane), click Create Certificate Request....
  • In the Request Certificate Wizard on the Distinguished Name Properties page, specify the following information:
Information Description
Common Name: Enter the fully qualified domain name (FQDN) (for example, www.example.com).
Organization: Enter the legally registered name of your company (e.g., Example GmbH).
Organizational Unit: The name of the department within the organization. This entry is often listed as “IT” or “Web security” or simply left blank.
City: Enter the city in which your company is legally located.
State/Province: Enter the state/province in which your company is legally located.
Country/Region: Select the country in which your company is legally located from the dropdown list.
  • Click Next.
  • On the Cryptographic Service Provider Properties page, provide the following information:
Information Description
Cryptography Service Provider: Select Microsoft RSA SChannel Cryptographic Provider from the dropdown list, unless you prefer another cryptographic service provider.
Bit length: Select 2048 from the dropdown list, unless you have a specific reason for choosing a larger bit length.
  • Click Next.
  • On the File Name page under Specify a File Name for Certificate Request, click the ... field to browse to a location where you want to save your CSR.

Note

Write down the file name and the location where you have saved the csr.txt file. If you enter a file name without specifying a location where the file should be saved, your certificate signing request is saved under C:\Windows\System32.

  • Click Finish.
  • Then open the file with a text editor (e.g., Notepad).
  • Copy the text including the tags -----BEGIN NEW CERTIFICATE REQUEST----- and -----END NEW CERTIFICATE REQUEST-----.
  • Paste the text into the DigiCert form.
  • To order your SSL certificate, click the following link: TLS/SSL Certificates. Please note that clicking on these web addresses will take you away from TRASER DOCS. TRASER Software GmbH is not responsible for the content on these websites.

You have successfully ordered an SSL certificate. Once you have received your SSL certificate from DigiCert, you can install it and assign it to a website.

Installing and Configuring an SSL Certificate on Windows Server 2016

After your SSL certificate has been validated and issued, you have to install it on the Windows Server 2016 where the certificate signing request was generated. Then, you have to set up the server. To do so, proceed as follows:

  • On the server where you created the CSR, save the .cer file for the SSL certificate (e.g., your_Domain_com.cer) that DigiCert sent to you.
  • Open the Internet Information Services (IIS) Manager from the Windows start menu.
  • In the Internet Information Services (IIS) Manager, click the server name in the Connections menu tree (left pane).
  • On the server name home page (center pane) in the IIS Manager, double-click Server Certificates.
  • On the Server Certificates page in the Actions menu (right pane), click Complete Certificate Request....
  • In the Complete Certificate Request wizard, enter the following information on the Specify Certificate Authority Response page:
Information Description
File name containing the certificate authority's response: Click the ... field and select the .cer file (e.g., Your_Domain_com.cer) that DigiCert sent to you.
Display Name: Enter a display name for the certificate. The display name is not part of the certificate, but is used to identify the certificate. We recommend adding DigiCert and the expiration date at the end of the display name, for example: yourpage-digicert-(expiration date). This information helps you with identifying the issuer and the expiration date of every certificate. It also helps you with distinguishing between different certificates with the same domain.
Select a certificate store for the new certificate: Select Web Hosting from the dropdown list.
  • Click OK to confirm your input.
  • In the menu tree Connections (left) under Internet Information Services (IIS) Manager, expand the name of the server on which the certificate was installed.
  • Expand Sites.
  • Click the website that you want to secure using the SSL certificate.
  • On the Default Web Site Home page in the Actions menu (right pane) under Edit Site, click Bindings....
  • In the Site Bindings window, click Add.
  • Enter the following information in the Add Site Bindings window:
Information Description
Type: Select https from the dropdown list.
IP Address: From the dropdown list, select the IP address of the website or select All Unassigned.
Port: Enter 443 in this field. The port through which traffic is protected by SSL is 443.
SSL certificate: Select your new SSL certificate from the dropdown list (e.g., yourdomain.com).
  • Click OK to confirm your input.

You have successfully installed your SSL certificate and set up the website to accept secure connections.

Installing Additional SSL Certificates with SNI

If you want to operate multiple websites on the same server, you need a separate SSL certificate for each domain. In addition, your server must support SNI (Server Name Indication) in order to manage multiple certificates via the same host or IP address. To install additional SSL certificates and assign them to a website, proceed as follows:

  • On the server where you created the CSR, save the .cer file for the SSL certificate (e.g., your_domain_com.cer) that DigiCert sent to you.
  • Open the Internet Information Services (IIS) Manager from the Windows start menu.
  • In the Internet Information Services (IIS) Manager, click the server name in the Connections menu tree.
  • On the server name home page (center pane) in the IIS Manager, double-click Server Certificates.
  • On the Server Certificates page in the Actions menu (right pane), click Complete Certificate Request....
  • In the Complete Certificate Request wizard, on the Specify Certificate Authority Response page, enter the following information:
Information Description
File name containing the certificate authority's response: Click the ... field and select the .cer file (e.g., Your_Domain_com.cer) that DigiCert sent to you.
Display Name: Enter a display name for the certificate. The display name is not part of the certificate, but is used to identify the certificate. We recommend adding DigiCert and the expiration date at the end of the display name, for example: yourpage-digicert-(expiration date). This information helps you with identifying the issuer and the expiration date of every certificate. It also helps you with distinguishing between different certificates with the same domain.
Select a certificate store for the new certificate: Select Web Hosting from the dropdown list.
  • Click OK.
  • The SSL certificate is installed.
  • Then, in the menu tree Connections (left) under Internet Information Services (IIS) Manager, expand the name of the server on which the certificate was installed.
  • Expand Sites.
  • Click the website that you want to secure using the SSL certificate.
  • On the Default Web Site Home page in the Actions menu (right pane) under Edit Site, click Bindings....
  • In the Site Bindings window, click Add.
  • Enter the following information in the Add Site Bindings window:
Information Description
Type: Select https from the dropdown list.
IP Address: From the dropdown list, select the IP address of the website or select All Unassigned.
Port: Enter 443 in this field. The port through which traffic is protected by SSL is 443.
Host Name: Enter the host name that you want to secure.
Require Server Name Indication: After entering the host name, select this checkbox. This is required for all additional certificates/sites after installing the first certificate and securing the main site.
SSL Certificate: Select your new SSL certificate from the dropdown list (e.g., yourdomain2.com).
  • Click OK.

You have successfully installed another SSL certificate and set up the website to accept secure connections.