How to Install an SSL Certificate in IIS

The IIS SSL flow overview

The five-stage flow:

1. Generate the CSR — IIS Manager (inetmgr) → server node → Server Certificates → Create Certificate Request; fill the common name (your exact domain), organisation details and 2048+ bit length.
2. Submit to the CA — paste the CSR into your provider's order form (Sectigo certificates issue in minutes for DV).
3. Complete the request — Server Certificates → Complete Certificate Request with the issued .cer file.
4. Add the HTTPS binding — Sites → your site → Bindings → Add: type https, port 443, hostname your domain, Require SNI for shared IPs.
5. Verify — browse to https:// and check the padlock; fix chains if warnings persist.

Each stage expands below with the clicks and the classic failures.

Step 1: generate the CSR

generate the CSR. Do this on one site or a staging copy first, then check the public URL in a private window so cache does not hide the result. Stop if the page errors, and email support@webji.services with the step name and the exact error before you repeat it on every account. WebJi® support mail is staffed 24/7 in Hindi and English; the phone line +91 141 4941811 is business hours only.

Step 2: submit and download the certificate

submit and download the certificate. Do this on one site or a staging copy first, then check the public URL in a private window so cache does not hide the result. Stop if the page errors, and email support@webji.services with the step name and the exact error before you repeat it on every account. WebJi® support mail is staffed 24/7 in Hindi and English; the phone line +91 141 4941811 is business hours only.

Step 3: complete the request and import

complete the request and import. Allow 80 and 443 to the world, and restrict SSH (22) or RDP (3389) to known IPs. A site that times out after a firewall change is usually a closed web port, not a dead server. If you lock yourself out, use the console in the client area or email support@webji.services before you reboot in a loop.

Step 4: HTTPS bindings and SNI

HTTPS bindings and SNI. Install the certificate on the account that actually serves the site, force HTTPS, then view the page source for http:// images, stylesheets or scripts. The padlock stays broken until those are HTTPS too. Renewal should be automatic; if the padlock disappears, check that the certificate is still bound to this hostname.

Fixing chains and moving pfx between servers

Padlock absent despite a bound certificate usually means an incomplete chain — the browser cannot walk your certificate up to a trusted root.

The fix: download the intermediate certificate bundle from your CA and import it (Server Certificates → Import, or MMC's certificate snap-in into Intermediate Certification Authorities), then iisreset and retest with SSL Labs until the chain reads complete.

Moving certificates between IIS servers, the .pfx dance: on the source, Server Certificates → Export with a password to a .pfx file; on the target, Import with the same password. The .pfx carries the private key, so transfer it encrypted and delete the copy after import — a leaked .pfx is the certificate equivalent of a leaked password.

IIS ships ready on Windows dedicated servers — certificates install into it exactly as here.

Let's Encrypt on Windows

Let's Encrypt on Windows. Do the change this heading names on one site first, then check it in a private browser window or in the mail client, depending on the topic. Change one setting at a time, and undo it if the result is wrong before you try the next. If you want the Jaipur desk to look with you, email support@webji.services — that mailbox is staffed 24/7 in Hindi and English. Phone +91 141 4941811 is business hours only.