This guide explains how to install an SSL certificate issued through ClouDNS on a Microsoft IIS web server. It covers Actalis, RapidSSL, and Sectigo certificates, installation in the Windows Certificate Store, HTTPS bindings, and troubleshooting.
Download your SSL certificate from the ClouDNS web panel. The certificate file will typically be named:
your-domain.com.crt |
On Windows Server, the required intermediate CA certificates are installed separately in the Windows Certificate Store. Select your Certificate Authority (CA) below to download the correct certificates before configuring IIS.
After downloading the appropriate CA certificates, continue with Step 2. Unlike Apache or Nginx, IIS does not require a combined fullchain file. |
Before installing your domain certificate in IIS, install the required intermediate CA certificate or certificates on the Windows server.
Press Windows + R and enter:
certlm.msc |
In the Certificates management console, navigate to:
Certificates (Local Computer) > Intermediate Certification Authorities > Certificates |
Right-click Certificates and select All Tasks > Import.... Select the intermediate certificate file and complete the Certificate Import Wizard.
If the chain contains more than one CA certificate, repeat the import for each required certificate. For Actalis DV RSA CA 2025, import the two files described in Step 1, including the cross-certificate.
You can alternatively import CA certificates using an Administrator Command Prompt:
certutil -addstore CA intermediate-certificate.crtFor the Actalis DV RSA 2025 hierarchy, the commands are:
certutil -addstore CA actalis_dv_tls_rsa_2025.pem
certutil -addstore CA actalis-crosscert-tls-rsa-2025-v3.crt| Certificate trust
Windows normally includes widely trusted public root certificates in the Trusted Root Certification Authorities store. Do not add a new root as a trusted root merely to suppress certificate validation warnings. The intermediate and cross-certificate files described here belong in Intermediate Certification Authorities. |
Open Internet Information Services (IIS) Manager from the Start menu or from:
Server Manager > Tools > Internet Information Services (IIS) Manager |
In the Connections pane, select the server, then open Server Certificates. In the Actions pane, select Complete Certificate Request....
Browse to the domain certificate downloaded from the ClouDNS web panel:
your-domain.com.crt |
Enter a friendly name (for example your-domain.com), select the Personal store if prompted, and click OK.
| Important
Complete the certificate request on the same server where the CSR was generated, because that server normally holds the matching private key. A domain certificate alone does not contain its private key. |
If the CSR was generated on another server or you already have a password-protected .pfx file containing the domain certificate and its matching private key, use the import option instead:
IIS Manager > Server Certificates > Import... |
Select the .pfx file, enter the password, and complete the import. Check that the resulting certificate has an associated private key.
In IIS Manager, expand Sites and select the website you want to secure. In the Actions pane, click Bindings....
To create an HTTPS binding, click Add... and configure:
| Setting | Value |
|---|---|
| Type | https |
| IP address | All Unassigned or the IP address of your website |
| Port | 443 |
| Host name | your-domain.com |
| SSL certificate | Select the certificate installed in Step 3 |
If multiple HTTPS websites use the same IP address and port 443, enable Require Server Name Indication and specify the correct hostname. SNI lets the websites use different certificates on the same IP address.
If the website has a dedicated IP address and SNI is not required, you can normally leave the hostname field empty.
Click OK to save the binding. If an HTTPS binding already exists, select it, click Edit..., choose the new certificate, and save the changes.
For a Multi-Domain or Wildcard SSL certificate, configure the necessary IIS site bindings only for hostnames covered by that certificate.
Open the website over HTTPS:
https://your-domain.com |
Confirm that IIS presents the correct certificate, its hostname matches, and the browser does not report certificate trust or chain errors.
Restarting IIS is normally not required after updating an HTTPS binding. The new certificate should take effect after the binding is saved.
If the binding does not work, inspect the certificates registered with Windows HTTP.sys from an Administrator Command Prompt:
netsh http show sslcertA separate SSL certificate is normally not required for each IIS server when the same certificate covers the hostnames served by those servers. You can install the same certificate and its corresponding private key on multiple IIS servers.
On the server that holds the certificate and private key, press Windows + R and enter:
certlm.msc |
Navigate to:
Certificates (Local Computer) > Personal > Certificates |
Find your SSL certificate, right-click it, and select:
All Tasks > Export... |
Choose Yes, export the private key, and create a password-protected .pfx file. Securely copy the file to the other IIS servers.
Import the PFX on each destination server using:
IIS Manager > Server Certificates > Import... |
Enter the password and import the matching Actalis, RapidSSL, or Sectigo intermediate CA certificates on each server as described in Step 2. Then configure the HTTPS bindings on each IIS server.
| Security
A PFX file contains the private key for your certificate. Protect it with a strong password, transfer it securely, and remove unnecessary copies after installation. |
A Wildcard SSL certificate such as:
*.domain.com |
normally covers first-level subdomains such as www.domain.com and mail.domain.com, but not deeper names such as server.mail.domain.com. It also does not automatically cover domain.com unless that name is separately included in the certificate.
If the SSL certificate is missing from the IIS certificate list or cannot be selected for an HTTPS binding, inspect it in the Windows Certificate Store.
Press Windows + R, enter certlm.msc, and navigate to:
Certificates (Local Computer) > Personal > Certificates |
Open the certificate and confirm the following:
|
If the certificate does not have an associated private key, IIS normally cannot use it for an HTTPS binding. This often happens when the certificate is imported on another server without its original private key.
Import a PFX containing both the certificate and private key, or reissue the certificate using a new CSR generated on the IIS server.
If browsers report an incomplete or untrusted chain, check the CA store:
Certificates (Local Computer) > Intermediate Certification Authorities > Certificates |
Make sure the correct Actalis, RapidSSL, or Sectigo intermediate CA certificates are installed. For the Actalis 2025 RSA DV hierarchy described in this article, also check the cross-certificate.
The installed intermediate must match the certificate Issuer. Download the appropriate files again from the official CA repositories listed in Step 1 if needed.
If the private key is still on the Windows server but the association with its certificate was lost, you can attempt to repair it.
Find the certificate Thumbprint and run from an Administrator Command Prompt:
certutil -repairstore my "CertificateThumbprint"Replace CertificateThumbprint with the actual thumbprint of your certificate.
| Important
This command cannot recreate a private key that no longer exists. If the key is missing, import a PFX containing it or reissue the certificate using a new CSR. |
If the certificate is installed correctly but HTTPS still fails, open:
IIS Manager > Sites > Your Website > Bindings... |
Verify the IP address, port, hostname, SNI option, and selected SSL certificate. You can also check the Windows HTTP.sys SSL bindings:
netsh http show sslcertAfter the correct certificate and binding are configured, IIS should start serving the updated SSL certificate without a full server restart.