Knowledge Base
How to install a PFX certificate on Microsoft IIS and bind it to a website
Overview
By the end of this article, you will have imported a PFX (Personal Information Exchange, .pfx/.p12) certificate into Microsoft Internet Information Services (IIS) and bound it to a website so the site serves traffic over HTTPS. The article covers the supported scope and prerequisites, importing the certificate in IIS Manager, creating the HTTPS site binding, verifying the certificate in a browser and in the Microsoft Management Console (MMC), and troubleshooting common issues. A PFX file packages the public certificate, the private key, and any intermediate certificates in a single password-protected file.
Scope
Applies to:
-
Windows Server 2016, 2019, or 2022
-
IIS 10.x
-
Certificates in PFX format containing the public certificate, the private key, and (optionally) the intermediate certificate chain
Prerequisites
-
Local Administrator access to the Windows server
-
IIS installed and configured
-
The PFX certificate file
-
The PFX password
-
A website already created in IIS
-
Port 443 open on the firewall or load balancer
Install the PFX certificate
Step 1 — Open IIS Manager
-
Log in to the Windows server.
-
Open Server Manager.
-
Go to Tools → Internet Information Services (IIS) Manager.
Step 2 — Import the PFX certificate
-
In IIS Manager, select the server name at the top of the left pane.
-
Double-click Server Certificates.
-
In the right-hand Actions pane, click Import.
-
Browse to the .pfx file, enter the PFX password, and select “Allow this certificate to be exported” (recommended).
-
Click OK. The certificate now appears in the Server Certificates list.
Bind the certificate to the website
Step 1 — Open Site Bindings
-
In IIS Manager, expand Sites and select the target website.
-
In the Actions pane, click Bindings.
Step 2 — Add or edit the HTTPS binding
-
Click Add (or Edit if an HTTPS binding already exists) and configure:
-
Type: https
-
IP address: All Unassigned (or a specific IP if required)
-
Port: 443
-
Host name: leave blank for the default, or enter the Fully Qualified Domain Name (FQDN) if you use Server Name Indication (SNI)
-
SSL Certificate: select the certificate you imported
-
Click OK, then click Close.
Verify the installation
Browser verification
-
Open a browser and go to your site (for example, https://yourdomain.com).
-
Confirm there are no certificate warnings, the Common Name (CN) or Subject Alternative Name (SAN) is correct, the expiration date is valid, and the certificate chain is trusted.
Windows verification
-
Open the Microsoft Management Console (MMC).
-
Add the Certificates snap-in for the Computer Account.
-
Go to Personal → Certificates and confirm the certificate shows a private key icon and the message “You have a private key that corresponds to this certificate.”
Troubleshooting
|
Issue |
Resolution |
|
Certificate not visible in IIS |
Ensure the PFX includes the private key. |
|
HTTPS binding fails |
Confirm port 443 is free. |
|
Browser shows the site as untrusted |
Install the intermediate certificates. |
|
Wrong certificate used |
Check the SNI setting and host name. |
|
“No private key” error |
Re-import the PFX correctly. |
Best practices
-
Include Subject Alternative Names (SANs) for all host names.
-
Use 2048-bit RSA (Rivest–Shamir–Adleman) or ECDSA (Elliptic Curve Digital Signature Algorithm) certificates.
-
Keep a secure backup of your PFX files.
-
Renew certificates before they expire.
-
Use SNI for servers that host multiple sites.
Security notes
-
Protect PFX files with strong passwords.
-
Delete PFX files after installation.
-
Restrict access to certificate private keys.
Related articles
How to Add a Cross-Sign Certificate to the Chain on Windows Platform (IIS)
Need assistance?
Contact our team for help with your purchase or issuing your certificate.
Live chat
Click the button below or click "Chat with an Expert" to start chatting with us now!
