{"id":7009,"date":"2021-12-03T00:06:53","date_gmt":"2021-12-03T05:06:53","guid":{"rendered":"https:\/\/www.caskeys.com\/dc\/?p=7009"},"modified":"2022-08-27T09:00:13","modified_gmt":"2022-08-27T13:00:13","slug":"installing-security-certificate-in-iis","status":"publish","type":"post","link":"https:\/\/www.caskeys.com\/dc\/installing-security-certificate-in-iis\/","title":{"rendered":"Installing Security Certificate in IIS"},"content":{"rendered":"\n

Thanks to the somewhat justifiable paranoia of most modern browsers, it’s nearly impossible to run a site without installing a third party security certificate. Try it and the end user’s browser will throw esoteric errors that lead them to believe you’re handing out the combination of their first born child’s hope chest. You can apply a self-signed certificate for development purposes, but don’t even think about self-signing production sites. The browsers will howl immediately, and at best your clients will complain. More likely, they’ll just leave and never return.<\/p>\n\n\n\n

For novice administrators (and sometimes experts too), installing third party certificates is rather frustrating. I’ve been there plenty, and part of the problem is the lack of a simple step through. This guide by yours truly aims to fill that gap, and keep things simple as possible. There are more direct means if you want to get your hands dirty, but then, you probably wouldn’t need this guide. \ud83d\ude42<\/p>\n\n\n\n

Getting Started<\/h2>\n\n\n\n

Before getting started, you must purchase a security certificate from a trusted vendor. At the moment, InCommon<\/a> and GlobalSign<\/a> are the most popular. Once you have secured a certificate (pun intended), follow the steps below to get it installed and running on your site. <\/p>\n\n\n\n

Note this guide assumes Internet Information Services (IIS) version 10 and InCommon<\/a> as the certificate provider. Some steps may vary depending on version and vendor. If you are unsure, contact your vendor or leave a question in the comments below.<\/p>\n\n\n\n

Creating Certificate Signing Request (CSR)<\/h2>\n\n\n\n

Acquiring a certificate from your vendor requires sending a CSR. Some vendors offer a tempting automated setup option. Don’t fall for that trap. Automated CSR setups have dubious reliability, and IIS is notoriously finicky about certificates. You will find it simpler and less frustrating to perform the steps yourself. <\/p>\n\n\n\n

Open IIS Manager and select the target server.  <\/p>\n\n\n

\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n

Locate and open the Server Certificates plugin. It is included as part of the default IIS Installation.<\/p>\n\n\n

\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n

Select Create Certificate Request and fill out the name properties. The information you provide here largely depends on your relationship with certificate vendor. If there is a mismatch, the vendor may deny your certificate or IIS will throw errors during later steps that are very difficult to diagnose. <\/p>\n\n\n\n

  1. Common Name \u2013 Typically the domain name of your site.<\/li>
  2. Organization \u2013 Company\/Personal name. <\/li>
  3. Organizational unit – Department\/Compartmentalization.<\/li>
  4. City\/locality  <\/li>
  5. State\/province <\/li>
  6. Country\/region<\/li><\/ol>\n\n\n\n

    When you are finished filling out the form, click Next.<\/p>\n\n\n

    \n
    \"\"<\/a><\/figure>\n<\/div>\n\n\n

    At the Cryptographic Service Provider Properties dialog, select the following options, then click Next:<\/p>\n\n\n\n