IIS SSL Certificate Renewal

This article will demonstrate how to in IIS perform an SSL certificate renewal. The CA used in this article is on the same domain as the IIS server.

Install IIS on Windows

If not already installed, enable Internet Information Services (IIS) on Windows 10 or Windows 11 or a Windows server.

1. Open the Start menu
2. Type features and select Turn Windows features on or off
3. Select the Internet Information Services checkbox and then click OK
4. Wait for the installation to complete.

Manually request a certificate

To manually request an SSL certificate from a Certification Authority (CA), run this command.

certreq -submit -attrib "CertificateTemplate:PrivateWebServer" C:\Users\<user>\csr.pem

Where CertificateTemplate:PrivateWebServer is the name of the certificate template configured in the Microsoft CA you are requesting a certificate for and C:\Users\<user>\csr.pem is the path to the already generated CSR. For instructions on how to generate a CSR click here.

Microsoft CA for web server SSL certificates

Ensure permissions are correct on the certificate template.

Make sure correct CA role is installed for web requests. Read this article for more information.

Troubleshooting

If you encounter the error Certificate not issued (Denied) Denied by Policy Module The DNS name is
unavailable and cannot be added to the Subject Alternate name. 0x8009480f
Certificate Request Processor: The DNS name is unavailable and cannot be
added to the Subject Alternate name. 0x8009480f (-2146875377)
Denied by Policy Module when requesting a certificate then follow these steps.

In your Certificate Templates console:

1. Double click your template
2. Navigate to the Subject Name tab
3. Click the Supply in the request radio button
4. Check the Use subject information from existing certificates for autoenrollment renewal requests checkbox
5. Re-submit your certificate request

Automatic Certificate Enrollment in IIS

You can use group policy to configure automatic SSL certificate enrollment. On a domain controller open the Group Policy Management console.

1. Right click the domain or OU where you want to create the group policy
2. Click the Create a GPO in this domain, and Link it here… option
3. Give it a name and click OK
4. Right click the new GPO and click Edit
5. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies. You should see the Certificate Services Client – Auto-Enrollment policy.
6. Enable the policy, renew expired certificates, and Update certificates in the properties.

Next we will create a Certificate Request Setting.

1. Expand the Public Keys Policies folder
2. Right click the Automatic Certificate Request Settings
3. Select New > Automatic Certificate Request
4. Click Next to skip the Welcome screen
5. Select the template you are using for web server SSL certificates and click Next

IIS certificates should now be ready for auto renewal. This article goes into more depth.

On your certificate template on the Security tab make sure Autoenroll is selected for the right user. The answer in this forum goes into more depth on setting the right permissions.

In IIS, you should then enable IIS rebind.

1. Open Internet Information Services (IIS) Manager
2. In Connections, select the server
3. In Home > IIS, double click Server Certificates
4. In Actions click Enable Automatic Rebind of Renewed Certificate

Restart the certsvc service with this command.

net stop certsvc
net start certsvc

Powershell certificate request

You can use this PowerShell script as a starting point.

Conclusion – IIS SSL Certificate Renewal

This article has demonstrated how to request and renew certificates using IIS and a private Microsoft CA. Let us know in the comments if you have any questions or need clarification.