SSL Certificate Installation Instructions for Windows Server 2012

Securing your Windows Server 2012 with an SSL certificate is crucial for protecting sensitive data and building trust with your website visitors. This guide provides comprehensive Ssl Certificate Install Instructions For Windows 2012 Server, leveraging the user-friendly DigiCert® Certificate Utility for Windows. Whether you are new to SSL certificates or an experienced administrator, these step-by-step instructions will walk you through the entire process, from creating a Certificate Signing Request (CSR) to configuring your server to use the newly installed certificate.

For users seeking a streamlined approach to CSR creation and SSL certificate management on Windows, the DigiCert Certificate Utility offers a significant advantage. This tool simplifies complex tasks into intuitive, one-click operations. If you prefer alternative methods or cannot utilize the DigiCert Utility, you can refer to our guide on IIS 8 and IIS 8.5: Create CSR and Install SSL Certificate. However, for the most efficient and straightforward experience, especially on Windows Server 2012, we highly recommend using the DigiCert Utility outlined below.

Step 1: Generating Your CSR on Windows Server 2012 with DigiCert Utility

The DigiCert Certificate Utility for Windows simplifies the CSR generation process, making it accessible even for users with limited experience. Creating a CSR is the first essential step in obtaining your SSL certificate.

Step-by-Step Guide to CSR Creation with DigiCert Utility

Download the DigiCert Certificate Utility: Begin by downloading the executable file, DigiCertUtil.exe, directly onto your Windows Server 2012. You can find the download link here: DigiCert Certificate Utility.
Launch the Utility: Once downloaded, locate DigiCertUtil.exe and open the DigiCert Certificate Utility by double-clicking the file.
Navigate to CSR Creation: Within the DigiCert Certificate Utility interface, click on the SSL tab (represented by a gold lock icon). Then, proceed by clicking the Create CSR button.

Enter CSR Details: The Create CSR page will appear, prompting you to input the necessary information for your Certificate Signing Request. Carefully fill in the fields as described below:

Field	Description	Example
Certificate Type:	Ensure SSL is selected from the dropdown menu.	SSL
Common Name:	Enter the Fully Qualified Domain Name (FQDN) for which you intend to use the SSL certificate. This is typically your website address.	www.yourdomain.com
Subject Alternative Names (SANs):	If you are securing multiple domains or subdomains with a Multi-Domain (SAN) Certificate, input all the SANs you wish to include. Separate each domain name with a comma.	www.yourdomain.com, yourdomain.com, mail.yourdomain.com
Organization:	Provide the legally registered name of your company or organization.	Your Company, Inc.
Department:	Specify the department within your organization responsible for the SSL certificate. Common entries include “IT,” “Web Security,” or you can leave it blank if not applicable.	IT
City:	Enter the city where your organization is legally registered.	New York
State:	Select the state where your company is legally located using the dropdown list. For companies outside the United States, you can manually type the state or province name.	California
Country:	Choose the country where your organization is legally registered from the dropdown list.	US
Key Size:	Select 2048 from the dropdown menu for the key size. This is the recommended standard for security. Only choose a larger size if you have a specific requirement.	2048
Provider:	Choose Microsoft RSA SChannel Cryptographic Provider from the dropdown unless you are mandated to use a specific cryptographic provider. This is the standard and widely compatible provider for Windows Server environments.	Microsoft RSA SChannel Cryptographic Provider

Generate and Save or Copy CSR: After entering all the required details, click the Generate button. The DigiCert Certificate Utility will then display the generated CSR. You will be presented with two options:

Option	Description	Recommendation
Copy CSR	Clicking Copy CSR will copy the entire CSR text to your clipboard. This is useful if you are immediately pasting the CSR into the DigiCert order form. Important Note: The DigiCert Utility does not save CSRs automatically. If you choose this option, immediately paste the copied CSR into a text editor like Notepad and save it. If you close the CSR window or overwrite your clipboard without saving, you will need to regenerate the CSR.	Use this option if you are comfortable immediately pasting the CSR and remember to save it externally.
Save to File	Clicking Save to File allows you to save the CSR as a .txt file directly onto your Windows Server 2012.	Highly Recommended: This is the safer and more convenient option. Saving to a file ensures you have a persistent copy of your CSR that you can easily access and use later.

Close the CSR Window: Click Close to exit the CSR generation window in the DigiCert Utility.
Retrieve and Submit CSR: If you saved the CSR to a file, locate the .txt file and open it with a text editor (like Notepad). Copy the entire content of the file, including the -----BEGIN NEW CERTIFICATE REQUEST----- and -----END NEW CERTIFICATE REQUEST----- tags. Paste this CSR text into the designated field in your DigiCert order form to proceed with your SSL certificate purchase.

Once you have your CSR, you are ready to order your SSL certificate from DigiCert.

Buy Now Learn More
Install Your SSL Certificate: After DigiCert processes your order and issues your SSL certificate, you will receive the certificate files. You will then use the DigiCert Certificate Utility again to install the certificate on your Windows Server 2012.

Step 2: Installing Your SSL Certificate on Windows Server 2012 Using DigiCert Utility

After obtaining your SSL certificate from DigiCert, the next step is to install it on your Windows Server 2012. This section details how to use the DigiCert Certificate Utility to import and install your SSL certificate file.

If you have not yet created a CSR and ordered your SSL certificate, please refer back to Step 1: Generating Your CSR on Windows Server 2012 with DigiCert Utility.

Upon receiving your SSL certificate files from DigiCert, you can proceed with the installation using the DigiCert Certificate Utility. After installation, you will configure IIS 8 or IIS 8.5 to bind the certificate to your website.

Follow the steps below to install your SSL certificate on Windows Server 2012:

i. Importing Your SSL Certificate via DigiCert Certificate Utility

The DigiCert Certificate Utility simplifies the import process, ensuring your SSL certificate is correctly installed in the Windows Server 2012 certificate store.

Microsoft Certificate Store Location: When using the DigiCert Certificate Utility for SSL certificate import and installation, the certificates are placed in the Personal certificate store by default, rather than the Web Hosting store. For most installations with fewer than 30 certificates, this placement is not problematic. However, if you manage a larger number of certificates (30 or more), it is recommended to move your certificates to the Web Hosting store, which is designed for handling a greater volume of certificates. Instructions for moving certificates can be found here: Move a Certificate from the Personal Store to the Web Hosting Certificate Store.

Detailed Steps to Import your SSL Certificate

Prepare Certificate File: On your Windows Server 2012, locate the ZIP file containing your SSL certificate files received from DigiCert. Extract the contents of this ZIP file (typically containing a .cer file, e.g., your_domain_com.cer) to the same folder where you saved the DigiCert Certificate Utility executable (DigiCertUtil.exe).
Open DigiCert Utility: Launch the DigiCert Certificate Utility by double-clicking DigiCertUtil.exe.
Initiate Certificate Import: In the DigiCert Certificate Utility, click the SSL tab (gold lock icon) and then click the Import button.
Browse for Certificate File: In the Certificate Import wizard window, click Browse to locate the .cer certificate file you extracted from the ZIP file (e.g., your_domain_com.cer). Select the file and click Open.
Proceed to Next Step: Click Next in the Certificate Import wizard.
Enter a Friendly Name: You will be prompted to enter a friendly name for the certificate in the “Enter a new friendly name or you can accept the default” box.

Importance of Friendly Name: The friendly name is not part of the SSL certificate itself but serves as an identifier within your server’s certificate store. It is highly recommended to use a naming convention that includes the issuing Certificate Authority (CA), such as DigiCert, and the certificate’s expiration date. For example: yourdomain.com-digicert-(expiration date). This practice is crucial for easily identifying the issuer and expiration date of each certificate, especially when managing multiple certificates for the same or different domains.
Complete Import: To finalize the SSL certificate import process, click Finish.
Confirmation Message: Upon successful import, you should receive a confirmation message indicating that the certificate was imported successfully. Your newly installed SSL certificate will now be visible within the DigiCert Certificate Utility interface.
Repeat for Additional Certificates (Optional): If you have additional SSL certificates to install, repeat steps 3-8 for each certificate.
Assign Certificate to Website: With the SSL certificate successfully installed, the final step is to configure your website in IIS 8 or IIS 8.5 to utilize this certificate for secure connections.

ii. Configuring Windows Server 2012 to Use Your SSL Certificate with IIS 8 & 8.5

After importing your SSL certificate, you must configure Internet Information Services (IIS) to associate the certificate with your website, enabling HTTPS and secure communication. The following sections provide instructions for both single and multiple certificate scenarios.

Configuration for a Single SSL Certificate

These steps are for configuring a single SSL certificate to secure a website on your Windows Server 2012.

Open IIS Manager: Access the Internet Information Services (IIS) Manager on your Windows Server 2012. You can find it by searching for “Internet Information Services (IIS) Manager” in the Start screen.
Navigate to Website Bindings: In the IIS Manager, within the Connections pane on the left, expand the server name where you installed the certificate. Then, expand Sites and select the specific website you intend to secure with the SSL certificate.
Access Bindings: On the website’s Home page in the center pane, locate the Actions menu on the right-hand side. Click on Bindings….
Add New Binding: In the Site Bindings window that appears, click the Add… button to create a new site binding.

Configure Binding Settings: In the Add Site Binding window, configure the following settings:

Setting	Value
Type:	Select https from the dropdown list. This specifies that you are creating a binding for secure HTTPS connections.
IP address:	Choose the IP address for your website from the dropdown. You can select the specific IP address assigned to the site, or choose All Unassigned if you want the binding to apply to all IP addresses configured on the server.
Port:	Enter 443. Port 443 is the standard port for secure HTTPS traffic.
SSL certificate:	From the SSL certificate dropdown list, select the friendly name of the SSL certificate you just installed. This will be the friendly name you assigned during the import process in the DigiCert Certificate Utility (e.g., yourdomain.com-digicert-(expiration date)).

Apply Binding: Click OK in the Add Site Binding window to save the configuration.
Verify Configuration: Your SSL certificate is now successfully installed and bound to your website. The Site Bindings window will now show the newly added HTTPS binding with your chosen SSL certificate.

Configuration for Multiple SSL Certificates (using SNI)

For hosting multiple websites on a single Windows Server 2012, each requiring its own SSL certificate, Server Name Indication (SNI) is essential. SNI allows the server to present the correct certificate based on the hostname requested by the client. Follow these steps to install and configure multiple SSL certificates using SNI.

If you have not yet imported all your SSL certificates, refer back to Import Your SSL Certificate Using the DigiCert Certificate Utility and import all certificates before proceeding.

The process for configuring multiple SSL certificates with SNI involves two main parts: assigning the first certificate and then assigning subsequent certificates using SNI.

Assign the First SSL Certificate (One-Time Setup)

Perform these steps only once for the initial SSL certificate configuration.

Open IIS Manager: Launch the Internet Information Services (IIS) Manager on your Windows Server 2012.
Navigate to Website Bindings: In IIS Manager, go to the Connections pane, expand your server name, then Sites, and select the website for your first SSL certificate.
Access Bindings: On the website’s Home page, in the Actions menu, click Bindings….
Add Binding: In the Site Bindings window, click Add….

Configure First Certificate Binding: In the Add Site Binding window, configure the following:

Setting	Value
Type:	Select https.
IP address:	Choose the website’s IP address or All Unassigned.
Port:	Enter 443.
SSL certificate:	Select the friendly name of your first SSL certificate from the dropdown list.

Apply First Certificate Binding: Click OK. The first SSL certificate is now configured.

Assign Additional SSL Certificates (Using SNI)

Repeat these steps for each additional SSL certificate you need to configure using SNI.

Navigate to Website Bindings: In IIS Manager, navigate to the Connections pane, expand your server and Sites, and select the website for the next SSL certificate.
Access Bindings: On the website’s Home page, click Bindings… in the Actions menu.
Add Binding: In the Site Bindings window, click Add….
Configure SNI Binding: In the Add Site Binding window, configure the following settings for each additional certificate:

| Setting | Value