Installing an SSL certificate on IIS follows a different process than Nginx/Apache — using Windows' certificate store and IIS's management console rather than configuration files. This guide covers the complete process.
Prerequisites
- Windows Server with IIS installed (see How to Install IIS on Windows Server)
- A domain pointed at your server
Option 1 — Using win-acme for Free Let's Encrypt Certificates (Recommended)
win-acme is a popular, well-maintained ACME client for Windows, automating the entire Let's Encrypt process similarly to Certbot on Linux.
Step 1 — Download win-acme
Invoke-WebRequest -Uri "https://github.com/win-acme/win-acme/releases/latest/download/win-acme.v2.zip" -OutFile "win-acme.zip"
Expand-Archive win-acme.zip -DestinationPath C:\win-acmeStep 2 — Run win-acme
cd C:\win-acme
.\wacs.exeFollow the interactive prompts: select your IIS site, and win-acme automatically requests, validates, and installs the certificate, including binding it to your site in IIS.
Step 3 — Verify Auto-Renewal Task Was Created
Get-ScheduledTask -TaskName "win-acme*"win-acme sets up a scheduled task to handle automatic renewal, similar to Certbot's cron-based renewal on Linux.
Option 2 — Installing a Commercial Certificate Manually
Step 1 — Generate a CSR via IIS
In IIS Manager: Server Certificates → Create Certificate Request, fill in your organization details, and save the resulting CSR file.
Step 2 — Submit the CSR to Your Certificate Authority
See How to Generate a CSR and Install a Commercial SSL Certificate for the general CA submission process.
Step 3 — Complete the Pending Request
Once the CA issues your certificate, in IIS Manager: Server Certificates → Complete Certificate Request, selecting the certificate file provided by your CA.
Step 4 — Bind the Certificate to Your Site
In IIS Manager, select your site: Bindings → Add, choose https, port 443, and select your installed certificate from the dropdown.
Step 5 — Verify HTTPS Is Working
https://yourdomain.comRedirecting HTTP to HTTPS in IIS
Requires the URL Rewrite module — add a rewrite rule redirecting all HTTP traffic to the HTTPS equivalent, configured either through IIS Manager's URL Rewrite interface or directly in web.config.
Verifying the Certificate Chain Is Complete
echo | openssl s_client -connect yourdomain.com:443 -showcertsRun this from a separate Linux machine or WSL if openssl isn't natively available — verify multiple certificates appear in the chain, as covered in Understanding Certificate Chains and Intermediate Certificates.
Common Errors
Certificate installed but site still shows HTTP — verify the HTTPS binding was actually added in IIS Manager, not just the certificate installed into the certificate store.
win-acme fails to validate domain ownership — verify the domain's DNS correctly points to this server and port 80 is reachable for HTTP-01 validation (win-acme's default method).
Continue Reading
- How to Install IIS on Windows Server
- How to Generate a CSR and Install a Commercial SSL Certificate
- Understanding Certificate Chains and Intermediate Certificates
Browse more articles in SSL/TLS & Certificates.
