How do I install an SSL Certificate into Microsoft IIS 7?

Problem

How do I install an SSL Certificate into Microsoft IIS 7?

Resolution

This tutorial will be given in 3 parts.  All parts must be completed, but you may find that either Part I and/or Part II may already be completed depending on your security settings and the version of your Windows Server.  If the certificate installation is a renewal of an already existing QuoVadis certificate, you may not need to do Parts I and II as you should already have installed the certificates previously.  The intermediate files must also be installed to ensure that some browsers do not show a certificate error.

Part I - Installing the Intermediate (chaining) Certificate

Part I explains how to install the intermediate files that are required.  QuoVadis uses an intermediate certificate that must be installed on the server to prevent errors in certain browsers.  You may want to go through these steps and if the intermediate certificate is not installed, then please obtain it and follow through with the rest of Part I.  These files have been included in this knowledge base article.

First you must open the Microsoft Management Console.
  1. Click on Start and then Run.

  2. In the Run window, type MMC in the Open: field and click on the OK button.

  3. The Console1 window will appear.

  4. Click on File at the top and then select Add/Remove Snap-in...  Alternatively, you can press Ctrl + M.

  5. In the Add/Remove Snap-in window, click on the Add... button at the bottom.  This will open a third window named Add Standalone Snap-in.

  6. Scroll down in the Add Standalone Snap-in window and find the Certificates component.  Once found, highlight it and click on the Add button at the bottom.  Alternatively, you can double-click on Certificates.

  7. In a new window, you will be given 3 options for which account you want the certificates snap-in to manage.

  8. Select the Computer account radio button and click on the Next button.

  9. At the next screen, click on the Finish button.

  10. Back in the Add Standalone Snap-in window, click on the Close button.

  11. Click on the OK button in the Add/Remove Snap-in window.

  12. You should be back in the Console1 window.  You will see that the Certificates (Local Computer) has been added on the left hand pane.

  13. Click on the "+" sign next to Certificates (Local Computer) to expand it.

  14. Locate and expand the Intermediate Certification Authorities store and then click on the Certificates folder underneath it.

  15. In the right hand pane, you should see a list of certificates.  Verify that you have the QuoVadis Global SSL ICA G2 certificate in this list of certificate in the right hand pane.  If you do have this certificate in the Intermediate Certification Authorities store, then you can skip to Part II.  If you do not, then the next steps will guide you through the process of installing this file.

  16. Place the certificate in a directory where it can be accessed by the server.

  17. Right-click on the Certificates folder underneath the Intermediate Certification Authorities folder and in the drop-down menu, select All Tasks and then click on Import.

  18. The Certificate Import Wizard will appear.  At the welcome screen, click on the Next button.

  19. You must specify the file to import.  Click on the Browse... button and find and select the QuoVadis Global SSL ICA G2 certificate.  Once selected, it should appear in the File name: field.  Click on the Next button.

  20. On the next screen, the option for Place all certificates in the following store should be selected by default and in the Certificate store: field should be Intermediate Certification Authorities.  Click on the Next button.

  21. At the summary screen, click on the Finish button.

  22. You should get a message that reads, "The import was successful."

Part II - Installing the Root Certificates

Generally, your Windows Server should have the QuoVadis Root certificates installed, however there have been cases where they have not been.  When you install the SSL certificate, if the root certificate is not present, the system will prompt you to trust it, which will also install it.  For Part II, you will be installing the QuoVadis Root Certification Authority and the QuoVadis Root CA 2, which expires 2031.  Part II assumes that you currently have the Microsoft Management Console open.  If you do not, you can find the instructions in Part I of this guide, steps 1-9.
  1. Click on the "+" sign next to Certificates (Local Computer) to expand it (if it isn't already expanded).

  2. Locate and expand the Trusted Root Certification Authorities store and the click on the Certificates folder underneath it.

  3. In the right hand pane, you should see a list of certificates.  Click on any certificate that you see and press the letter "Q" on your keyboard to fast-track to the QuoVadis root certificates.  Verify that you have the QuoVadis Root CA 2 certificate in this list of certificates in the right hand pane.  If you see the QuoVadis Root CA 2 certificate, please make sure that the expiry date of this certificate is 2031 and not 2017.  If the certificate is present, then your website should not show any trust errors then you can skip to Part III.  If you do not see this certificate in the Trusted Root Certification Authorities store, then the next steps will guide you through the process of installing this file.

  4. Place the certificate in a directory where it can be accessed by the server.

  5. Right-click on the Certificates folder underneath the Trusted Root Certification Authorities folder and in the drop-down menu, select All Tasks and then click on Import.

  6. The Certificate Import Wizard will appear.  At the welcome screen, click on the Next button.

  7. You must specify the file to import.  Click on the Browse... button and find and select the QuoVadis Root CA 2 certificate.  Once selected, it should appear in the File name: field.  Click on the Next button.

  8. On the next screen, the option for Place all certificates in the following store should be selected by default and in the Certificate store: field should be Trusted Root Certification Authorities.  Click on the Next button.

  9. At the summary screen, click on the Finish button.

  10. You should get a message that reads, "The import was successful."

Part III - Installing the Certificate

Part III explains how to install the SSL certificate and bind (assign) it to a website.
  1. Click on Start.  Go to Administrative Tools and then click on Internet Information Services (IIS) Manager.

  2. Click on the name of the server in the left Connections pane.  This should be the same server that you previously created a CSR for.

  3. In the middle pane, double-click on Server Certificate icon.

  4. In the right Actions pane, click on Complete Certificate Request...

  5. In the Complete Certificate Request window that appears, click on the ellipses (...) button and navigate to the server certificate you received from QuoVadis.

  6. Type in a name for this certificate in the Friendly name: field and then click on the OK button.

  7. Note: The friendly name is a name given to the certificate which is used to help differentiate between certificates.

    You should see your newly installed certificate in a list.

  8. Go back into the left Connections pane and expand the Sites folder and select the website that you want to bind (install) the SSL certificate to.

  9. Once the Web Site is selected, click on the Bindings... link in the right Actions pane.

  10. The Site Bindings window appears.  Click on the Add... button.

  11. In the Add Site Binding window, change the Type: field to "https" by selecting it from the drop-down menu.

  12. In the SSL certificate: field, select the friendly name of the certificate that you installed.  Once you have selected this, click on the OK button.

  13. Note: In most cases, the IP Address: field will be kept to All Unassigned unless the website has a specific IP Address it needs to be assigned too.

  14. Back in the previous Site Bindings window, you should see the binding for port 443 in the list.  Click on the Close button once completed.

OCSP Stapling Support

Although optional, it is highly recommended to enable OCSP Stapling which will improve the SSL handshake speed of your website.

Windows Server 2008 automatically utilizes OCSP Stapling by default.  No additional configuration is required.

You can read up on more on OCSP Stapling at https://support.quovadisglobal.com/KB/a415/what-is-ocsp-stapling.aspx.

Add Feedback