--- title: "Mastering IIS Certificate Requests with PowerShell" description: "Secure your IIS websites like a pro. Step-by-step guide to IIS certificate requests and binding using PowerShell." canonical: "https://adamtheautomator.com/iis-certificate-request/" --- # Mastering IIS Certificate Requests with PowerShell > Secure your IIS websites like a pro. Step-by-step guide to IIS certificate requests and binding using PowerShell. Source: https://adamtheautomator.com/iis-certificate-request/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Mastering IIS Certificate Requests with PowerShell](https://adamtheautomator.com/wp-content/uploads/2019/06/5d238ae5c824b514689ea564.jpg) # Mastering IIS Certificate Requests with PowerShell [![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)26 June 20194 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Certificates](/tag/certificates/)[IIS](/tag/iis/)[PowerShell](/tag/powershell/) Table of Contents * [The Mission](#the-mission) * [How it’s Done, Son!](#how-it-s-done-son-summary) * [Generating the IIS Certificate Request](#generating-the-csr) * [Completing the IIS Certificate Request](#completing-the-csr) * [Create the SSL Binding](#create-the-ssl-binding) * [Attach the Certificate to the SSL Binding](#attach-the-certificate-to-the-ssl-binding) * [Get the PowerShell IIS Script](#get-the-powershell-goodies) * [Example code](#example-code) If you want to learn how to generate an IIS certificate request, you’ve come to the right place. In this article, I’m going to cover how I did this with PowerShell and also how to bind a certificate to an IIS website. Not a reader? Watch this related video tutorial! **_Not seeing the video? Make sure your ad blocker is disabled._** Let’s get one thing straight. I __hate__ cryptography and certificates. Over my career, I’ve been the “[certificate](https://adamtheautomator.com/x509-certificates/) guy” on a few occasions. However, it was just another hat for a system administrator. I never got to the point where I completely understood the technology and it seemed like every task I tried to accomplish around that area seemed to never work out. It’s definitely an unforgiving technology for sure. Let me tell you a story about automating getting a certificate installed on an IIS server with PowerShell. ## The Mission From a client, request a new public Digicert certificate, get it installed on a remote Windows Server 2012 R2 Core Server running IIS 8.5 in a workgroup, set a SSL binding to a website and use the installed certificate for the binding. Simple, right? LOLz! ## How it’s Done, Son! In a nutshell, it takes X steps to make this happen. 1. Generate a IIS certificate signing request __on the computer where the cert will be installed__. In my case, I only had WinRM access so I had to execute _certreq.exe_ on the remote server using [`Invoke-Command`](https://adamtheautomator.com/invoke-command/ "Invoke-Command") and send the content of the CSR to a local file. 2. Get the CSR signed by a public CA. (No help here -a pretty cert just came back from security that I worked with). In my case, the security team gave me back a P7B collection of certs rolled up into a .CER file which included the cert I was looking for as well as the intermediate certs. This took a bit of tinkering to work. 3. Complete the certificate signing request __on the computer where the cert will be installed__. This will get the certificate into the certificate store. 4. Create a SSL IIS web binding on the server. 5. Attach the certificate to the web binding. ## Generating the IIS Certificate Request Your first [task will be to run _certreq.exe_ with this PowerShell](https://adamtheautomator.com/powershell-scheduled-task/) IIS script on the remote server to gather up a request file. To do this, _certreq.exe_ requires an INF file as input. This file is used for all the various options your certificate will end up having. Without going into a ton of detail, this is a copy of the INF file that I was using. ```powershell [Version] Signature = "$Windows NT$" [NewRequest] Subject = "C=US,S=State,L=City,O=Company,OU=IT,CN=Name" Exportable = TRUE KeyLength = 2048 KeySpec = 1 KeyUsage = 0xa0 MachineKeySet = True ProviderName = "Microsoft RSA SChannel Cryptographic Provider" ProviderType = 12 Silent = True SMIME = False RequestType = PKCS10 ``` You’ll see in the `New-CertificateSigningRequest` function that I make it super-easy for you to customize this. Actually, if you use my functions you’ll never even see this file as it’s only needed temporarily to create the CSR (request file). Next, you’ll need to get this INF file on the remote server and run _certreq.exe_ with the following parameters like `certreq.exe -new "$InfFilePath" "$reqFilePath"`. This will generate a CSR (request file) on the remote computer. You’ll then need to send this file to your security team. This will also create a certificate containing both the private key and the public key in the _Certificate Issued Requests_ in the local machine context. ![Certificate service request in the Windows MMC snapin](https://adamtheautomator.com/content/images/2019/07/automating-iis-ssl-certificate-installation-with-powershell---certificateinstore-1.png) Certificate service request in the Windows MMC snapin ## Completing the IIS Certificate Request In my case, I got back a single CER file. I created a function in this PowerShell IIS script to simply import this directly into the Personal store in the local machine context to find that IIS couldn’t see it. The reason was that the certificate had to contain the private key as well. Simply importing the certificate into the Personal store would not work. I had to complete the certificate request use _certreq.exe_. To do this, you will need to copy the certificate you receive from your security team onto the remote server and then execute _certreq.exe_ like this `certreq.exe -accept -machine "C:\issuedcert.cer"`. You’ll always need to ensure that the response certificate always goes into the local machine context by using the `-machine` parameter. This __should__ complete successfully according to everything I read but it definitely did not for me. For some reason, I was receiving an error that looked like this: ![Error requesting certificate](https://adamtheautomator.com/content/images/2019/07/automating-iis-ssl-certificate-installation-with-powershell---certificate-request-error-2.png) Error requesting certificate It turns out this means that the public key in the request file did not match what was returned by the security team. To test this, simply run `certutil.exe -dump requestfile.req` and `certutil -dumpissuedcert.cer`. Scroll down through the output until you see the public key area. ![Encrypted public key](https://adamtheautomator.com/content/images/2019/07/automating-iis-ssl-certificate-installation-with-powershell---certificate-public-key-hex-1.png) Encrypted public key Copy out each of these private keys and compare in a text editor to ensure they’re the same. If not, get onto your security team for not signing your request right! If those match, you’re good and you should not receive that error. ## Create the SSL Binding On the remote server run: ```powershell PS> Import-Module WebAdministration PS> New-WebBinding -Name $WebsiteName -IP * -Port 443 -Protocol https ``` ## Attach the Certificate to the SSL Binding On the remote server, run: ```powershell PS> $certificate = Get-Item Cert:\localmachine\My\$Thumbprint PS> $certificate | New-Item "IIS:\SSLBindings\0.0.0.0!443" ``` ## Get the PowerShell IIS Script If all goes well, you should be done! Now, if you need a little help doing this I’ve created three functions to make it happen a lot easier. Head on over to my Github repo to get the functions: [https://github.com/adbertram/Random-PowerShell-Work/tree/master/Certificates](https://github.com/adbertram/Random-PowerShell-Work/tree/master/Certificates) [https://github.com/adbertram/Random-PowerShell-Work/tree/master/IIS](https://github.com/adbertram/Random-PowerShell-Work/tree/master/IIS) ## Example code ```powershell ## Send the file that this outputs to your certificate people New-CertificateSigningRequest -SubjectHost 'somesubject' -FilePath 'C:\somefile.req' -ComputerName REMOTESERVER ## Import the cert receieved Import-CertificateSigningRequestResponse -FilePath C:\issuedcert.cer -ComputerName REMOTESERVER ##Create the binding and attach the cert. New-IISWebBinding -ComputerName 'zapp09rpr01' -WebsiteName GHI -Protocol https -Port 443 -Certificate $cert ``` Related Reading Be sure to check out this other ATA blog posts on managing IIS with PowerShell * [How to Manage IIS Websites with PowerShell](https://adamtheautomator.com/powershell-iis/) * [Managing IIS Web Application Pools with PowerShell](https://adamtheautomator.com/powershell-iis-2/) Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fiis-certificate-request%2F&text=Mastering%20IIS%20Certificate%20Requests%20with%20PowerShell)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fiis-certificate-request%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fiis-certificate-request%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2021/05/How-to-Create-a-Self-Signed-Certificate-with-PowerShell.jpg) ### [New-SelfSignedCertificate: Creating Certificates with PowerShell](/new-selfsignedcertificate/) Don't want to spend on third-party certificates when developing websites or testing applications? Learn how to create self-signed certificates with the New-SelfSignedCertificate cmdlet for free in this tutorial. ![](https://adamtheautomator.com/wp-content/uploads/2019/12/microsoft-IIS-1280x720-1.png) ### [PowerShell IIS Mastery: Create and Manage Websites](/powershell-iis/) Become an expert in managing IIS with PowerShell. Create websites, configure settings, and automate tasks to level up your IT skills. ![](https://adamtheautomator.com/wp-content/uploads/2019/06/5d238ae5c824b514689ea5a5.jpg) ### [Managing IIS App Pools: A PowerShell Tutorial](/powershell-iis-2/) Learn to create, modify, and remove IIS application pools using PowerShell. Your guide to efficient IIS management. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)