# How do I install a SSL certificate on a Windows Server/IIS 10 web server? **URL:** \ **Category:** Help\ **Created:** [February 13, 2024, 5:37pm UTC](https://community.letsencrypt.org/t/how-do-i-install-a-ssl-certificate-on-a-windows-server-iis-10-web-server/213215 "2024-02-13T17:37:11Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![needsslhelp](https://avatars.discourse-cdn.com/v4/letter/n/dec6dc/32.png) [@needsslhelp](https://community.letsencrypt.org/u/needsslhelp)\ **Post date:** [February 13, 2024, 5:37pm UTC](https://community.letsencrypt.org/t/how-do-i-install-a-ssl-certificate-on-a-windows-server-iis-10-web-server/213215/1 "2024-02-13T17:37:11Z")
Hello, Our organization is running an instance of REDCap (an open-source database platform) on a Windows Server 2022 VM with IIS 10. The REDCap configuration check is indicating "recommended that you use SSL (i.e. https) on your web server when hosting REDCap. If your server does not already have an SSL certificate, you will need to obtain one." Can someone help explain the process by which I can obtain an SSL certificate and install it on our server? Thank you very much! Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: (this is a web-based database that is only available on our local network) I ran this command: It produced this output: My web server is (include version): IIS 10 The operating system my web server runs on is (include version): Windows Server 2022 My hosting provider, if applicable, is: I can login to a root shell on my machine (yes or no, or I don't know): I don't know I'm using a control panel to manage my site (no, or provide the name and version of the control panel): The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): Don't know ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [February 13, 2024, 5:40pm UTC](https://community.letsencrypt.org/t/how-do-i-install-a-ssl-certificate-on-a-windows-server-iis-10-web-server/213215/2 "2024-02-13T17:40:52Z")
> [@needsslhelp](#): > > My domain is: (this is a web-based database that is only available on our local network) Is the domain in the public DNS? If not, you cannot get a certificate using Let's Encrypt (or any other publicly trusted CA for that matter). ---
**Author:** ![needsslhelp](https://avatars.discourse-cdn.com/v4/letter/n/dec6dc/32.png) [@needsslhelp](https://community.letsencrypt.org/u/needsslhelp)\ **Post date:** [February 13, 2024, 5:57pm UTC](https://community.letsencrypt.org/t/how-do-i-install-a-ssl-certificate-on-a-windows-server-iis-10-web-server/213215/3 "2024-02-13T17:57:47Z")
Hello, Thanks very much for your note. No, it is not in the public DNS. It is only visible/available from computers on our LAN. That said, do you know how I would go about obtaining/installing a certificate that would allow https connections to that server? Much obliged! ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [February 13, 2024, 6:05pm UTC](https://community.letsencrypt.org/t/how-do-i-install-a-ssl-certificate-on-a-windows-server-iis-10-web-server/213215/4 "2024-02-13T18:05:22Z")
> [@needsslhelp](#): > > That said, do you know how I would go about obtaining (…) As said before: you can't obtain a certificate from a publicly trusted CA for a local only hostname. You can however use e.g. a self-signed (not trusted by default) certificate or set up your own private CA. There are multiple guides to do so on the internet. > [@needsslhelp](#): > > (…) installing a certificate that would allow https connections to that server? I'm a Linux only guy, so me personally wouldn't know. Perhaps someone else might, but you'd need a certificate first obviously. ---
**Author:** ![needsslhelp](https://avatars.discourse-cdn.com/v4/letter/n/dec6dc/32.png) [@needsslhelp](https://community.letsencrypt.org/u/needsslhelp)\ **Post date:** [February 13, 2024, 6:22pm UTC](https://community.letsencrypt.org/t/how-do-i-install-a-ssl-certificate-on-a-windows-server-iis-10-web-server/213215/5 "2024-02-13T18:22:38Z")
Thank you very much. In the meantime, I found a thread on StackExchange that seems to explain how to do it. > Many thanks! ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [February 13, 2024, 10:56pm UTC](https://community.letsencrypt.org/t/how-do-i-install-a-ssl-certificate-on-a-windows-server-iis-10-web-server/213215/6 "2024-02-13T22:56:21Z")
> [@needsslhelp](#): > > Can someone help explain the process by which I can obtain an SSL certificate and install it on our server? If your clients are all joined to your Windows AD domain [assuming you have an AD domain], then they would trust any cert issued by your domain CA. If you have clients that are NOT joined to your domain [or you don't have an AD domain], then they would have to either: - be provided with a cert from a trusted CA - manually install/trust the CA cert that signed the cert you created ---
**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\ **Post date:** [February 14, 2024, 2:04am UTC](https://community.letsencrypt.org/t/how-do-i-install-a-ssl-certificate-on-a-windows-server-iis-10-web-server/213215/7 "2024-02-14T02:04:39Z")
Personally I'd suggest just using a name that's valid in your public DNS and getting a real trusted certificate. You can use DNS domain validation instead of HTTP domain validation so that you don't need to expose the server to the public internet (as required by HTTP validation). Domain validation is the process whereby the Certificate Authority (Let's Encrypt) checks that you control the domain in question before issuing a cert. As the developer I'm biased but I'd suggest firing up [https://certifytheweb.com](https://certifytheweb.com) and giving that a spin. There's a bunch of different DNS providers supported: [DNS Validation (dns-01) | Certify The Web Docs](https://docs.certifytheweb.com/docs/dns/validation) The general process is to set your IIS bindings to include the correct hostname your certificate is going to be for (e.g. `redcap.whatever.yourdomain.com`) then in the app: - choose _New Certificate_ and select your IIS Site, the hostname(s) will be listed for inclusion in the cert - on the _Authorization_ tab setup your DNS validation credentials (or try it out temporarily with the Manual DNS option). - click _Request Certificate_ to start the process, once complete you will have a certificate automatically applied to the IIS bindings matching the hostname(s) on the cert. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [March 15, 2024, 2:05am UTC](https://community.letsencrypt.org/t/how-do-i-install-a-ssl-certificate-on-a-windows-server-iis-10-web-server/213215/8 "2024-03-15T02:05:08Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.