SSL guides & resources
Install and renew SSL certificates in Windows IIS
Check the Windows certificate store, private-key association and IIS HTTPS bindings. Plan renewal and verify the certificate served by each website.
Before starting, record the Windows Server and IIS versions, site names, hostname bindings and any load balancer in front of the server. An IIS server certificate, a client certificate and a remote-desktop certificate serve different purposes; changing one does not automatically update the others.
Coordinate with the application owner. An internal business portal may depend on older clients, specific authentication settings or integrations that need testing after a certificate replacement.
In this guide
A practical checklist
Locate the request and private key
If IIS generated the CSR, complete the request on the machine or approved environment holding its matching key. If the certificate was issued elsewhere, the administrator may need a protected PFX import containing the key. Do not assume a CER file contains a private key.
Review the certificate in Windows
Use the appropriate certificate-management tools to check subject/SAN names, validity and private-key association. Confirm the issuer chain is available in the correct stores according to the issuer and Windows deployment instructions.
Update the site’s HTTPS binding
Select the intended site in IIS Manager and review its bindings. Check the IP, port, hostname and any SNI requirement before selecting the new certificate. Preserve existing application authentication and access settings.
Verify using the public hostname
Test from a separate client, not just from the server console. Check the certificate shown for every relevant binding. If a reverse proxy or load balancer terminates TLS first, verify that layer separately.
Test the application and document renewal
Check login, forms, APIs and any scheduled integrations. Record the certificate thumbprint/reference internally, expiry and next responsible administrator. On a multi-server deployment, record completion for each endpoint.
Common problems and decisions
The certificate cannot be selected or has no private key
Check where the CSR was generated and whether the import included the matching key. Reimport through the approved process or arrange reissuance; renaming a file will not restore a missing key.
A renewed certificate is present but users see the old one
Inspect the live binding and any fronting endpoint. A new entry in the certificate store does not automatically mean every site binding now uses it.
A shared address hosts several HTTPS sites
Review hostname bindings and SNI compatibility for the actual clients. Do not replace a shared binding without identifying the other sites that depend on it.
Prepare for the next conversation
For support, provide the server/IIS versions, public names, binding arrangement and whether the key is already on the server. Agree a secure method for any PFX transfer and a separate channel for its password. A BDT quotation should distinguish certificate supply from IIS installation and ongoing replacement work.
Continue with the right guide or service
Common questions
Does a CER or CRT file include my private key?
Usually it contains only public certificate data. A PFX/PKCS#12 package can contain a key, so treat it as sensitive.
Do I need to replace every IIS binding at renewal?
Review all bindings that use the expiring certificate. Only the intended sites should change, and each affected hostname should be verified.
Will installing the certificate also secure an API behind a load balancer?
Only if the relevant TLS endpoints are configured. The public load balancer and IIS origin may use different certificates.
Can a website SSL certificate be used for software signing?
No. Select a certificate and key-management process appropriate to code signing; an ordinary website TLS certificate is not a substitute.