To configure SSL certificates in IIS, generate a CSR, import the certificate, and set up HTTPS bindings. First, create a CSR via IIS Manager under Server Certificates, fill in the Distinguished Name Properties with correct domain and organization details, and save the request to submit to a CA. Second, once the certificate is received, use Complete Certificate Request to import it, ensuring the private key is correctly associated and stored in Local Machine. Third, configure site bindings by adding an HTTPS binding with the correct IP, port 443, and selected certificate, using Host Headers if hosting multiple SSL sites on the same IP to avoid conflicts and ensure compatibility with older clients.

Setting up SSL certificates in IIS isn’t complicated if you know the steps, but it’s easy to run into issues if something’s missed. Here’s a straightforward breakdown of how to configure SSL certificates and bindings properly.

Generate a Certificate Request (CSR)

Before installing a certificate, you need to generate a CSR. This is the first step whether you're getting a cert from a public CA or using an internal one.

• Open IIS Manager and go to Server Certificates under your server node.
• Click Create Certificate Request on the right-hand side.
• Fill in the Distinguished Name Properties:
  • Common Name is usually your domain (like example.com or www.example.com)
  • Organization, Organizational Unit, City, State, and Country are all part of the identity
• Choose a cryptographic provider and bit length—Microsoft RSA SChannel Cryptographic Provider with 2048 bits is standard these days.
• Save the request file somewhere safe and submit it to your certificate authority.

Make sure the Common Name matches the site exactly. If you’re securing multiple domains or subdomains, consider a SAN certificate instead.

Import the SSL Certificate

Once you get the certificate back from the CA, it's time to import it into IIS.

• Back in Server Certificates, click Complete Certificate Request.
• Browse to the certificate file provided by your CA and give it a friendly name (this helps later when managing).
• Make sure the certificate store is set correctly—usually "Local Machine" is fine unless you have specific requirements.

If the certificate doesn't show up after importing, double-check that the private key is properly associated. Sometimes permissions or mismatched keys cause the cert not to bind properly.

Configure Site Bindings with HTTPS

Now that the certificate is installed, you need to bind it to your website.

• Go to your site in IIS Manager and click Bindings on the right.
• Add a new binding or edit an existing one.
• Set the type to https, choose the IP address (or All Unassigned), port 443 (unless you're doing something unusual), and select the certificate you just imported.

A few things to watch for here:

• If multiple sites are hosted on the same IP, make sure each has a unique binding.
• Use Host Headers if you're hosting multiple SSL sites on the same IP and port.
• For older clients (like Windows XP), make sure SNI isn’t required unless you can live without supporting those users.

Binding mismatches are a common source of SSL errors like ERR_SSL_PROTOCOL_ERROR or certificate mismatch warnings.

That’s basically all there is to it. Just remember: the CSR must match the cert, the cert needs to be properly imported with access to the private key, and the bindings must align with your setup. It’s not rocket science, but attention to detail makes the difference between a secure connection and a broken one.

The above is the detailed content of Configuring SSL Certificates and Bindings in IIS. For more information, please follow other related articles on the PHP Chinese website!