Website Security Solutions | Latest Guides | Blog

Internet Information Services (IIS) is a flexible, general-purpose web server from Microsoft that runs on Windows systems to serve requested HTML pages or files. An IIS web server accepts requests from remote client computers and returns the appropriate response. This guide will show you how easily you can secure your server/website(s) hosted on the IIS 10 Web Server from Microsoft.

Step 1. Generating a CSR and Private Key

You will first have to generate a CSR (Certificate Signing Request) using the inbuilt IIS CSR Generator.

Open your Server Manager and then further proceed to launch the IIS 10 Manager.

1: Select your Server and navigate to Server Certificates under IIS.

IIS 10 Homepage

2: On the top-right corner, click on an option called Create Certificate Request.

IIS 10 CSR Request

3: Fill in all your details accordingly and click on next.

IIS 10 Fill CSR Details

Country Name (2 letter code) [AU]: Type in the 2 letter abbreviation for your country.

State or Province Name (full name) [Some-State]: Full name of the state

Organization Name (eg, company) [Internet Widgits Pty Ltd]:Locality Name (eg, city) []: Complete name of the city, no abbreviations

Organization Name (eg, company) [Internet Widgits Pty Ltd]: If you are a business; Enter your legal entity name. If you're not a business, any value entered will not be used in your certificate.

Organizational Unit Name (eg, section) []: If you are a business; Write the appropriate division of your company. It is best to use something generic such as "IT".

Common Name (e.g. server FQDN or YOUR name) []: Enter your domain name

Email Address []: Enter your email address

4: Select the Microsoft RSA Cryptographic provider and fix the bit length as 2048 and click on Next

IIS 10 Select CSR Provider

5: Name your CSR txt file and save it on your computer and click on finish.

IIS 10 Save CSR

Step 2. Order and Configure the SSL Certificate

Now we need to order an SSL Certificate. If you visit our SSL Certificates List page, you will have a selection of Certificates you can order. If you have a simple website wanting to secure the one domain, you will be fine to use a Comodo PositiveSSL. If you are a business website you may want to look at using a Business SSL, we recommend a GeoTrust SSL such as the True Business SSL.
If you require any assistance with selecting an SSL Certificate, please feel free to contact our sales team and they will be happy to assist.

1: Order the SSL and complete the checkout.

2: Once you have completed the SSL Certificate Purchase you can begin the configuration process. This can be started by going into your SSLTrust account and managing your recent purchase.

manage ssl

You then will need to click the Submit Configuration button to begin the configuration process.

submit ssl configuration

3: You now need to paste in the CSR you generated using the OpenSSL library in the Ubuntu CLI. This includes the lines:

  -----BEGIN CERTIFICATE REQUEST----
  -----END CERTIFICATE REQUEST-----
configure SSL

Select Apache for your Web Server Type.

ssl admin details

You will need to also enter the Site Administrator Contact Information.

This information is to be of the individual who is responsible to approve and SSL Certificate. If it is a business SSL, it needs to be a contact under the business.

The Technical Contact Information is the details of the individual responsible for the installation and management of the Certificate.
If you have ordered a business SSL, you will also be required to enter your business details. These should be the correct address and phone number and legal entity name. They will be required to be validated by the Certificate Authority, any mistakes will cause delays. More information on Business Validation can be found here.

4: Click Continue to go to the next Step. Here you need to select the Authentication Method to validate your domain name. This is required to prove you own the domain name and have permission to issue an SSL Certificate for the domain.

select domain validation method

Select the method that will be the easiest for you to use; File-Based Authentication ( HTTP / HTTPS ), CNAME Based Authentication ( DNS ) or Certificate Approver Email.

If you have access to one of the listed emails, this can be the quickest method

Click Continue/Submit to finish the Configuration process.

After you complete the domain validation via your selected method, your SSL will be issued. If you ordered a Business SSL, you will need to wait for the Certificate Authority to complete the Business address and phone validation. If the validation has not progressed, or you have not received your Certificate after some time, please contact our support team so we can check on its status.

sectigo validation manager

Step 3. Upload the SSL Certificate files to your server

When your SSL Certificate has been issued, you will be emailed the Certificate Directly from the Certificate Authority. You can also download it from your SSLTrust Portal. Downloading it from the SSLTrust Portal is a good option as we format the certificate in an easy to use way.

Again; View your certificate management page within SSLTrust

manage ssl

1: Click on the Manage button and collect/download your certificate.

download ssl button

2: Set the download option as a single .pem extension containing all the certificate files and click on download

Download SSL Certificate as a .pem file

3: Navigate to your hosted website's default directory and upload your certificate.

Step 4. Install the SSL Certificate on your IIS 10 WebServer

1: On the main IIS Homepage, navigate to Server Certificates again.

IIS 10 Homepage

2: Click on Complete Certificate Request option on the top-right corner.

IIS 10 Complete Request

3: Select the destination of the uploaded certificate and click on Ok to save the certificate.

IIS 10 Complete Request Details

Step 5. Enable the Installed SSL Certificate

1: Add an HTTPS binding to enable secure connections to your website. Go to the hosted website's main page and click on bindings on the top-right corner.

IIS 10 Bindings

2: To add a new binding, click on Add.

IIS 10 Add Bindings

3: Type in you host (domain) name and select your installed ssl certificate.

IIS 10 Edit Bindings

4: Go to your hosted website's homepage again and click on SSL Settings.

IIS 10 Hosted Website Homepage

5: Once you're in the settings, make sure you requireSSL and ignore Client certificates. Then, click on Apply on the top-right corner.

Step 6. Check the SSL is working

It is a good idea to go to your website and see if it works via https://www.yourdomain.com We also recommend you use this tool to check the install has been completed successfully: www.ssllabs.com/ssltest/



A2 Hosting SSLLabs A RatingYou may need to get your web developer, or update your website yourself, to make sure all files use https:// and all links to your site and within your website use https://
If you require any assistance with your SSL Installation please contact our friendly support team.

Further Configuration

If you do not get an SSLLabs Test, you will have to man"A" Rating (Best SSL Practices and strongest SSL Chain) on the Qualys ually disable older SSL Protocols. It is recommended that you get a developer to do this for you or contact us if you need any help.

Save the following script as a .reg file and execute it to change some low-level settings.

Note:- The directories mentioned below are different for different server versions. Make sure to manually change the directories if required, for the script to be executed successfully.

        Windows Registry Editor Version 5.00

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client]
        "DisabledByDefault"=dword:00000001
        "Enabled"=dword:00000000

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]
        "DisabledByDefault"=dword:00000001
        "Enabled"=dword:00000000

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client]
        "DisabledByDefault"=dword:00000001
        "Enabled"=dword:00000000

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server]
        "DisabledByDefault"=dword:00000001
        "Enabled"=dword:00000000

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client]
        "DisabledByDefault"=dword:00000001
        "Enabled"=dword:00000000

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server]
        "DisabledByDefault"=dword:00000001
        "Enabled"=dword:00000000

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client]
        "DisabledByDefault"=dword:00000001
        "Enabled"=dword:00000000

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server]
        "DisabledByDefault"=dword:00000001
        "Enabled"=dword:00000000

OR manually navigate to above directories and set DisabledByDefault to "1" in all cases for older SSL Protocols(TLS 1.0, TLS 1.1, SSLV2 and SSLV3) for both Client and Server folders.


Author: Siddiqui Ammar
Published:

    Next Guide...
    Micrsoft IIS-8 SSL Configuration and Installation Guide

    Internet Information Services (IIS) is a flexible, general-purpose web server from Microsoft that runs on Windows systems to serve requested HTML pages or files. An IIS web server accepts requests from remote client computers and returns the appropriate response. This guide will show you how easily…