SSL Setup with PFX in IIS (Windows) — Password and Binding

IIS (Internet Information Services), which runs on Windows Server, expects certificates in the PFX format, unlike Linux. PFX (PKCS#12) combines the certificate and the private key into a single encrypted .pfx file. In this guide, we'll show you how to import the PFX file into IIS and set up a site binding.

What is a PFX file?

PFX gathers three pieces (the certificate, the private key, and the intermediate chain) into a single container. The file is protected by a password; you'll be asked for this password during import. This structure makes it easy to safely move the key into the Windows certificate store.

When you generate your certificate with our free SSL wizard, the downloaded ZIP includes a ready-to-use certificate.pfx file. The PFX password is shown to you on the download screen; note this password down because you'll need it during the import step.

Step 1 — Import the PFX into Windows

Open IIS Manager and click the server name in the left panel. In the center panel, open the Server Certificates icon.

1. Click the Import... link in the right panel.
2. In the Certificate file (.pfx) field, select the certificate.pfx file.
3. In the Password field, enter the PFX password given on the download screen.
4. Leave the certificate store as Personal and click OK.

Step 2 — Add the site binding

After the certificate is added to the list, you need to define a binding to publish the relevant site over HTTPS:

1. In the left panel, under Sites, click the relevant site.
2. Open the Bindings... option from the right panel.
3. Click Add...; select https as the Type and 443 as the Port.
4. From the SSL certificate menu, select the certificate you just imported.
5. If multiple sites share the same IP, check the Require Server Name Indication (SNI) box and enter the host name.

Step 3 — Redirect from HTTP to HTTPS

The URL Rewrite module is used for redirection in IIS. Add the following rule to your site's web.config file:

<configuration>
  <system.webServer>
    <rewrite>
      <rules>
        <rule name="HTTP to HTTPS" stopProcessing="true">
          <match url="(.*)" />
          <conditions>
            <add input="{HTTPS}" pattern="off" />
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}/{R:1}"
                  redirectType="Permanent" />
        </rule>
      </rules>
    </rewrite>
  </system.webServer>
</configuration>

redirectType="Permanent" produces a 301 redirect and tells search engines that the move is permanent.

Quick import with PowerShell (optional)

If you want to automate the task across many servers, you can also import the PFX with PowerShell:

$pwd = ConvertTo-SecureString -String "YOUR_PFX_PASSWORD" -AsPlainText -Force
Import-PfxCertificate -FilePath "C:\certs\certificate.pfx" `
  -CertStoreLocation Cert:\LocalMachine\My -Password $pwd

Common problems

• "The password you entered is incorrect": Make sure you use the PFX password from the download screen exactly; watch out for leading/trailing spaces.
• The certificate doesn't appear in the bindings list: Check that you imported it into the Personal/My store.
• SNI conflict: If there are multiple HTTPS sites on the same IP, define an SNI host name for each.

Summary

Installing SSL in IIS comes down to importing the encrypted certificate.pfx file and defining a binding on port 443. If you don't have a PFX, generate your certificate with our free SSL wizard; follow these steps with the certificate.pfx from the ZIP and the password shown to you.