IIS separates certificate installation from actually using it on a site, via two distinct steps in IIS Manager.
- In IIS Manager, select the server (not a specific site) and open "Server Certificates," then "Complete Certificate Request" if you have a CA-issued certificate response file, or "Import" if you have a PFX file with both certificate and private key.
- Select your specific site, open "Bindings," add a new binding for port 443 with type "https," and select the certificate you just installed from the dropdown.
If you're hosting multiple sites on one IP, ensure SNI is enabled on the binding (a checkbox in the binding dialog) so IIS can serve the correct certificate per hostname.
What to do if your certificate doesn't appear in the IIS certificate store
If a certificate you've obtained doesn't show up when trying to bind it in IIS Manager, confirm it was imported into the correct certificate store (typically Local Computer > Personal) using the Certificates MMC snap-in, since IIS only shows certificates from this specific store location.
How IIS handles multiple sites needing different certificates on one server
IIS uses SNI-based bindings (available since IIS 8) to serve different certificates for different hostnames on the same IP and port, configured individually per site binding — confirming SNI is enabled on each binding is necessary for multi-site HTTPS hosting on a single IIS server.
What Server Name Indication requirements mean for older Windows Server versions
SNI-based multiple-certificate hosting requires IIS 8 or later, running on Windows Server 2012 or later — an older Windows Server version limits you to one certificate per IP address, which is worth confirming if you're troubleshooting unexpected certificate selection behavior on an older server.
How to export a certificate from IIS for use on another server
Using the Certificates MMC snap-in's export function, including the private key, produces a PFX file that can be imported onto another Windows server or converted to PEM format for use elsewhere, following the conversion techniques covered in our dedicated format conversion guide.
Why IIS's certificate binding is separate from the certificate's presence in the certificate store
Simply having a certificate imported into the Windows certificate store doesn't automatically apply it to any site — it must also be explicitly bound to a specific site and port through IIS Manager's binding configuration, a separate step from importation that's easy to overlook.
What Windows Server's built-in Certificate Enrollment tools add for enterprise environments
For organizations running their own internal Active Directory Certificate Services, Windows Server's built-in certificate enrollment tools integrate directly with IIS for internal-facing applications, distinct from the public CA workflow covered in this guide and more relevant to internal, domain-joined infrastructure.
How to troubleshoot an IIS site that shows the wrong certificate for its hostname
If IIS serves an unexpected certificate for a specific hostname, checking the site's binding configuration in IIS Manager confirms whether SNI is correctly enabled and whether the binding is actually associated with the certificate you expect, rather than a different certificate bound to the same IP and port.
A closing note on IIS's certificate handling compared to Linux-based servers
IIS's certificate handling, built around the Windows certificate store and GUI-driven binding configuration, feels meaningfully different from the file-path-based approach Nginx and Apache use — worth expecting this adjustment if you're more familiar with Linux server administration moving to a Windows-based IIS deployment.
A final practical tip for teams managing several IIS servers
For teams managing several IIS servers, PowerShell's WebAdministration module lets you script certificate binding and management tasks consistently across multiple servers, rather than manually repeating the same GUI steps on each one individually.