How to Install a Wildcard SSL Certificate on Windows Server 2025 (IIS)

Securing your subdomains with a wildcard SSL certificate is one of the most efficient ways to manage multiple sites under the same domain on Windows Server 2025 (IIS). Whether you want to take full control via manual installation and configuration methods or prefer a hands-off approach using a seamless automated solution (e.g., GeoTrust Horizon’s AutoInstall SSL agent), this guide walks you through both approaches.

What Is a Wildcard SSL Certificate?

A wildcard SSL certificate is a small file that allows you to secure a domain and all of its single-level subdomains. For example, you could secure all first-level subdomains on your domain (e.g., *.example.com covers www.example.com, blog.example.com, mail.example.com, etc.) using one certificate.

This saves time and money compared to purchasing separate certificates for each subdomain individually and simplifies certificate management.

Let’s dive into the two methods you can use to install a wildcard SSL certificate on your Windows Server 2025 IIS.

Manual Method: Wildcard SSL Installation in IIS (Windows Server 2025)

Step 1: Generate a Certificate Signing Request (CSR)

Start by generating a CSR in Windows Server IIS:

1. Open (IIS Manager) (inetmgr).
2. Select your server from the left-hand Connections panel.
3. Double-click Server Certificates in the center pane.
4. In the right pane, click Create Certificate Request (CSR).
5. Fill out the form:
   • Common Name: Use a wildcard domain by adding an asterisk (*) at the subdomain level you want to secure. For example, *.yourdomain.com secures all first-level subdomains.
   • Organization: Your company’s official details (i.e., its registered business name).
   • Location / Country: Based on your registered business address.

On the next screen:

6. Select Microsoft RSA SChannel Cryptographic Provider with 2048-bit encryption (as a minimum). Hit Next to exit this screen and move on to the next step.

7. Under the Actions column on the right, select the Complete Certificate Request option.

8. This will take you to another screen where you can input the friendly name for your CSR. A good rule of thumb is to incorporate the domain name into the csr file name.
9. Hit Finish to generate the CSR.

Step 2: Submit the CSR to Your Certificate Provider

Once you’ve generated your certificate signing request, the next step is to submit it to the certificate authority (CA) from which you purchased your SSL/TLS certificate.

Every CA’s process will look slightly different — some require you to paste the CSR into a form, while others allow you to upload the .csr file directly. Be sure to carefully follow the instructions provided by your CA to avoid delays in issuance.

To access your CSR file, navigate to the folder where you saved it and you can copy-paste the data as needed.

If You’re Using GeoTrust Horizon:Purchasing your certificate through GeoTrust.com makes this step easy. Instead of dealing with separate upload pages or complex forms, you can submit your CSR through your GeoTrust Horizon dashboard as part of the guided certificate enrollment process.

How to Upload Your CSR in GeoTrust Horizon and Request a Wildcard SSL

1. Go to GeoTrust.com and log in.
2. Click New Domain (or choose one from your existing list of domains) and hit Continue.
3. On the next screen, choose Manual Installation and hit Continue.
4. Here, you’ll be able to paste your CSR data.

In the next few steps, you’ll: 

• choose a domain control validation (DCV) method. Note: HTTP file-based validation isn’t an option for wildcard SSL/TLS certificates. For this example, we’ve selected DNS validation as our method.
• specify your organization’s admin and technical contact information.
• sign the subscriber agreement.

Once this process is complete, move on to the validation process.

Step 3: Create a DNS Record for Domain Validation

In order to prove ownership of your domain, you must complete the DCV process. You can do this either via the email validation process or the DNS record alternative.

For this example, we’ve chosen to go with the DNS validation method. For this, you’ll need to create a TXT record in your DNS provider’s control panel.

• A TXT record proves you have control of a domain.
• For SSL certificates, this record tells the certificate authority (CA) that you own and control the domain name being secured.
• The exact steps to create this record depend on your DNS hosting provider (e.g., GoDaddy, Cloudflare, Namecheap, AWS Route 53, etc.).

Important: Always copy the exact TXT details provided in the GeoTrust Horizon platform. Changing or formatting the entry incorrectly (such as adding your domain name twice in the “Host” field) can delay validation.

If you purchased your SSL certificate through GeoTrust.com, then you’ll find the value to use for your TXT record in your GeoTrust Horizon account dashboard. For example, for a single-domain wildcard SSL/TLS certificate, the record value might look like this:

Wait a few minutes for propagation. The GeoTrust Horizon platform will automatically verify the domain once the record is active. You’ll get a confirmation once the validation process is complete. (Note: This may require refreshing the pending validation in the GeoTrust Horizon dashboard.)

Step 4: Download and Prepare the SSL/TLS Certificate Files

After your domain has been validated, it’s time to gather your server and CA bundle files. (Note: If you’re using the same Windows server that the CSR was generated on using IIS Manager, then you don’t have to manually add the private key as it’ll be linked automatically. Otherwise, you’d need to use a .pfx file that contains the certificate and its private key if you’re transferring the certificate and key from another server.)

1. Download your certificate files from the GeoTrust Horizon dashboard:
   • Server certificate — Your domain’s wildcard SSL/TLS certificate (e.g., certificate.crt or yourdomain.com.crt)
   • CA intermediate certificate — This is part of your CA’s certificate chain (i.e., your_ca_bundle.ca-bundle)
2. On your Windows server, combine both the server and CA bundle certificates into a combined fullchain.pem certificate, if needed. (Note: This is likely unnecessary if you’re working on the same Windows server used to generate the CSR in IIS Manager):
   • Use Notepad to append the contents of the bundle below the main certificate.
   • Save as fullchain.pem.

Step 5: Install the Certificate in Windows Server IIS 2025

1. Back in IIS Manager, open Server Certificates.
2. Choose Complete Certificate Request from the right menu.
3. Browse to your fullchain.pem or main server certificate file. (If importing the server certificate only, you may need to separately import the CA bundle file under the MMC Snap-In > Certificates > Intermediate Certification Authorities > Certificates.)
4. Give it a recognizable Friendly Name (e.g., DomainWildcardSSL2025).
5. Click OK.

Step 6: Bind HTTPS to Your Website

1. Go to Sites in IIS, select your website.
2. Click Bindings > Add.
3. Choose:
   • Type: https
   • Port: 443
   • SSL Certificate: Select the one you just imported.
4. Save your changes.

7. Now, access your website using a secure version of the domain (e.g., https://yourdomain.com) — it should show a valid padlock or a secure connection message.

Enjoy Automatic Installation Using AutoInstall SSL

GeoTrust Horizon makes SSL installation and renewal completely hands-free with the AutoInstall SSL Agent for Windows Server 2016, 2019, 2022, and 2025. This method is perfect if you want to skip the manual steps and let the system take care of everything — from CSR generation to binding the certificate in IIS.

Step 1: Select Your Server and DNS Provider

1. Go to GeoTrust.com and log in to your account.
2. In the main dashboard, under the Assets heading, choose your domain/IP address or add a new one.
3. Begin the AutoInstall SSL installation and setup process. If you exited the GeoTrust Horizon platform previously and are trying to find it later, hit the Manage link, located next to your domain name under Assets.
4. On the next screen, find the specific certificate order and hit the Activate button under the AutoInstall SSL Status column.

Step 2: Select the Automated SSL Installation Method

On the next page, select Automatic Installation as your preferred method and hit Continue.

5. Next, select the Operating System of the server where the certificate will be installed (Windows Server (IIS).
6. Install the AutoInstall SSL agent on your server. Complete the AutoInstall SSL agent installation process using the string provided at this step in your GeoTrust Horizon dashboard:

powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls13 -bor [Net.SecurityProtocolType]::Tls12; iwr -useb https://files.autoinstallssl.com/packages/windows/version/latest/Win-AutoInstallSSL.ps1 | iex; }"

7. Check the box to confirm the agent is installed and hit Continue.
8. In the dropdown menu, select your DNS Provider (if prompted):

Examples of the DNS providers that GeoTrust Horizon supports include:

• AWS Route 53
• Cloudflare
• Digital Ocean
• DNS Made Easy
• GoDaddy
• Google Cloud DNS
• Microsoft Azure

Step 3: Generate Your DNS API Credentials

To allow the GeoTrust Horizon platform to automatically validate your domain using this DNS challenge authentication method (DNS-based authentication):

1. Get your AWS Route 53 Access Key ID and Secret Access Key. (Here’s how to set up API credentials in your AWS console.)
2. Click the button/link Generate API key for DNS validation for AutoInstall SSL.
3. Copy those and keep them safe — they’ll be used in the next step.

Step 4: Install Your SSL/TLS Certificate

Run the downloaded AutoInstallSSL.exe. Enter the following command to install your SSL/TLS certificate on your server using the AutoInstall SSL agent. Ensure you swap out the placeholder information (written below in [ALL_CAPITAL_LETTERS]) with your unique account information:

AutoInstallSSL.exe installcertificate --token [AUTOINSTALL_SSL_TOKEN_VALUE] --validationtype dns --validationprovider route53 --route53accesskeyid [AWS_ACCESS_KEY_ID] --route53secretaccesskey [AWS_SECRET_ACCESS_KEY]

During setup, you’ll paste the following in the command listed above:

• Your GeoTrust Horizon AutoInstall SSL API Key
• Your DNS Provider’s Access Key ID
• Your DNS Provider’s Secret Access Key

This process allows the AutoInstall SSL agent to:

• Generate the CSR automatically
• Validate your domain via a DNS challenge
• Download and install the SSL certificate
• Bind it to your site in IIS
• Set up automatic renewals with Task Scheduler

Step 5: Access Your Website to Confirm SSL

Once the setup process is complete, your website should immediately be available over HTTPS.

Open your browser and go to the secure version of your domain (e.g.,  https://yourdomain.com). You should see the padlock icon in the address bar, or a “connection is secure” type message confirming that the SSL certificate is installed correctly.

That’s it! Provided everything is installed correctly, you’ve set automation to autopilot and are free to go about your day.

FAQS About Installing a Wildcard on Windows Server 2025

Here are some answers to our most frequently asked questions:

Can I use one wildcard SSL for multiple subdomains?Yes. A wildcard like *.yourdomain.com covers all subdomains on a single level. For example, you can use one to cover all first-level subdomains (e.g., mail.yourdomain.com, blog.yourdomain.com, shop.yourdomain.com), but not yourdomain.com itself unless explicitly included.

What do I do if validation fails?Check your DNS propagation using a tool like whatsmydns.net and ensure your CNAME record matches exactly.

Can I switch from manual to automatic later?Absolutely — just install the AutoInstall SSL Agent and input your credentials.

Does AutoInstall SSL work behind firewalls or proxies?Yes, if outbound HTTPS is allowed for API communication.

Bonus Tips for a Smooth Installation Process

• Combine certificates in the correct order: domain certificate first, then intermediate bundle.
• Keep port 443 open on both firewall and cloud security groups to allow secure, encrypted traffic to flow.
• Always back up your private key and certificate, if generated manually.
• Use an online SSL/TLS testing tool (e.g., SSL Monitor) to check your server after installing the SSL/TLS certificate.