How to Install an SSL Certificate on Windows Server 2019

A data breach costs $4.4 million on average, according to IBM’s 2025 data. Learn how to install an SSL/TLS certificate on your Windows Server to secure your data in transit

A secure sockets layer/transport layer security (SSL/TLS) certificate is an essential tool that enhances your website’s security and trustworthiness.

This tiny digital file confirms your organization’s identity and encrypts data in transit to protect your website and users from cybersecurity threats. So, if you run a Windows server and want to install an SSL/TLS certificate but don’t know where to start, fear not.

In this tutorial, we’ll show you how to install an SSL/TLS certificate on Windows Server 2019 automatically and manually. You’ll learn how to:

• import your SSL/TLS certificate,
• bind it to your website, and
• automate the SSL/TLS installation process.

What You’ll Need to Install a Windows Server 2019 SSL Certificate

Before starting the installation process, you’ll need an SSL/TLS certificate that’s issued by a trusted certificate authority (CA) or vendor such as GeoTrust.

• For internal sites, you can issue this certificate yourself using an internally trusted (private) CA.
• For publicly trusted websites, you must use an SSL/TLS certificate from a publicly trusted CA.

Do you already have one? Fantastic. You can move to the next step to begin the installation process. If you don’t have an SSL/TLS certificate yet, then you have two options:

1. Manually generating your certificate signing request (CSR) in IIS Manager. We’ve got a separate guide that walks you through the steps of creating a CSR.
2. Creating and separately submitting your CSR through your certificate provider’s website. (Note: If you’re a GeoTrust certificate customer, you can send your request quickly and easily using the GeoTrust Horizon user dashboard.)

This process will involve validating your domain before the certificate authority issues your certificate. If you’re using a higher validation certificate (i.e., an organization validation [OV] or extended validation [EV]), then you’ll also have to undergo additional vetting of your business.

How to Install an SSL/TLS Certificate on Windows Server 2019

In this article, we’re going to take you through two types of installation methods:

• The manual installation method through the Internet Information Services (IIS) 10 Manager, and
• The automated process using GeoTrust Horizon AutoInstall SSL.

How to Manually Install an SSL/TLS Certificate on Windows Server 2019

Manually installing your SSL/TLS certificate includes several steps and requires some specific technical knowledge. However, it’ll give you complete control over the certificate setup.

In this example, we’re using IIS 10, the supported version of IIS at the time of writing this article.

Now, let’s install your SSL/TLS certificate using IIS on your Windows Server 2019.

• Save the SSL/TLS certificate .cer file (e.g., your_domain_com.cer) on your server.
• On your Windows platform, click Start, search for IIS, and open it.  

• In the left pane, under Connections, click your server’s name. This will open a bunch of options in the center screen.

• In the main (center) pane, under the IIS section, double-click the Server Certificates icon (as shown below).

Image caption: Here’s how to open your Windows server’s certificate page.

• In the same page’s Actions pane on the right, click Complete Certificate Request, as highlighted in the following screenshot.

Image caption: The screenshot shows how to open the certificate request wizard.

• The Complete Certificate Request wizard screen will populate. Click the “…” button to locate and select your SSL/TLS certificate file (.cer).

• In the Friendly Name field, enter a certificate name.

Pro tip: Add the CA’s name and the certificate’s expiration date to your friendly name as shown in the following example. This approach will help you easily identify the certificate, which certificate provider issued it, and when it expires.

Leave “Select a certificate store for the new certificate” as it is (i.e., Personal). Hit OK. This is the best option, as it’ll work smoothly with all applications. (Pro tip: Do you use IIS to manage a high number of certificates? Choose Web Hosting as the certificate store, as this approach will increase performance.) 

That’s it. You now know how to manually install an SSL/TLS certificate on Windows Server 2019. But don’t close the IIS Manager just yet. After you’ve installed your Windows Server 2019 SSL/TLS certificate, we still need to assign it to your website. This action will ensure all connections use the secure HTTPS protocol. Let’s start binding!

• In the IIS Manager, go back to the Connection section, expand the Sites folder, and select the domain where you want to install the certificate. In our example (below), we’ve called the website Default Web Site.

• In the right pane, under Actions, click Bindings.

• The Site Bindings window will pop up. Click Add and choose the following settings:
  • Type: https.
  • IP address: All Unassigned.
  • Port: port 443.
  • Host Name: Type your host name and tick the Require Server Name Indication box.

• Hit Select to choose your new SSL certificate and click OK.

Image caption: The screenshot shows the last steps to bind the SSL/TLS certificate to your website.

Pro tip: Does your Windows server host more than one website? If the answer is yes, you’ll need to specify which site the SSL/TLS certificate should be bound to. Under “IP address,” select the correct IP for the site you want to protect.

Voila’. Now everything is set up. You’ve installed your SSL certificate and configured your website to accept secure connections. Phew! That was quite a ride, right? If you’re a GeoTrust Horizon customer and want to save some time and effort, then keep reading.

How to Automatically Install an SSL/TLS Certificate on Windows Server 2019

GeoTrust Horizon AutoInstall SSL for Windows Server lets you deploy any SSL/TLS certificate automatically without breaking a sweat. It’s compatible with almost any dedicated or virtual private servers (VPS) hosting, including cloud servers such as Amazon Web Services Elastic Compute Cloud (AWS EC2) and  Azure virtual machines (VMs).

The beauty of it is that the tool takes care of everything — from certificate installation to deployment and renewal. This way, you’ll never have to worry about certificate expiration again.

Here’s how it works. In this demo, we’ll assume you have just created an account and purchased an SSL/TLS certificate through GeoTrust.com:

• On your GeoTrust.com dashboard, go to My Orders > All Orders, and click on the eye icon near the certificate you’ve bought.

A new page will open. Scroll down the page and click Complete Certificate Enrollment.

• Select your domain or enter a new one and hit Continue.

• Check the Automatic Installation radio button and click Continue.

Important: AutoInstall SSL currently supports domain validation (DV), single domain, and wildcard SSL certificates.

• Verify that the domain displayed is the one you want to protect with the SSL/TLS certificate. If it isn’t, change it by clicking on the pencil icon. Select the IIS (Windows) server environment.

• Connect to your web server as an administrator via remote desktop protocol (RDP) or secure shell (SSH). To install the AutoInstall agent on your server, copy and paste the script below into a Windows PowerShell terminal and press Enter:

powershell -Command "& { 
[Net.ServicePointManager]::SecurityProtocol = 
[Net.SecurityProtocolType]::Tls13 -bor 
[Net.SecurityProtocolType]::Tls12; iwr -useb https://files.autoinstallssl.com/packages/windows/version/latest/Win-AutoInstallSSL.ps1 | iex; }"

Note: The part in bold might change when a new AutoInstall version is published. Therefore, always compare the script with the one displayed by the tool (see screenshot below). 

• Tick the box to confirm that you’ve installed the agent and click Continue.

• At this point, the tool will display a page similar to the one in the screenshot below. As you can see, IIS is already selected, as are your chosen certificate validation and protection options. Nevertheless, if you wish, you can:
  • Change the validation method to DNS. For our demo, we’ve kept the standard choice, as it’s the easiest. However, if you want to install a wildcard certificate, you must select DNS validation because file-based validation isn’t supported for wildcards.
  • Depending on the certificate you purchased, you’ll also be able to choose whether to protect both yourdomain.com and www.yourdomain.com or only one of the two. If you opt for www.yourdomain.com, you must have the DNS records set up for the www. subdomain.

• This next screen may look a bit different, depending on the validation method you chose. For example, if you selected DNS validation, then you’ll see an additional step that requires you to collect your DNS API credentials. (Don’t worry, we provide a guide on how to do this for 10+ popular DNS providers.)

• As you’ve already installed the agent on your server in one of the previous steps, all you have to do now is copy and paste the command below into your server’s terminal window and hit Enter. Make sure you replace the placeholder text <token-value> in the example below with the token displayed in your AutoInstall SSL window. You can find this token value on the Manager Orders page in the GeoTrust Horizon dashboard. (See the screenshot below for the file validation method code.)

AutoInstallSSL.exe installcertificate --token <token-value> --includewww --validationtype file --validationprovider filesystem=

This simple script will set the following certificate installation tasks to autopilot:

• Generate the CSR,
  • Submit it to the CA,
  • Complete the validation operations,
  • Download the certificate,
  • Install the certificate, and
  • Restart your web server.

You’re done! From this point forward, AutoInstall SSL will check your certificate daily and update it as necessary to ensure it never expires. What more could you ask for?

Verify Your SSL/TLS Certificate Is Properly Installed on Windows Server 2019

Regardless of which installation method you chose, you’ll need to confirm that HTTPS is enabled on your website. Open your browser and go to your website:

• If you use Firefox or Edge, you should see a padlock icon on the address bar.

• In Chrome, click on the “tune” icon in the address bar to display a pop-up screen. Does it display a message again to: “Connection secure?” Well done — it means the installation of the SSL/TLS certificate on your Windows Server 2019 was successful.

To leave no stone unturned. Use an online SSL checker tool to verify:

• The full certificate chain was installed successfully
• No other dodgy errors have popped up  
• All modern browsers trust your SSL/TLS certificate

GeoTrust users can also quickly verify the installation on their dashboard, in the Order Details page.

Final Words About How to Install an SSL Certificate on Windows Server 2019

Using SSL/TLS certificates issued by a trusted CA fosters trust in your website and organization by:

• Assuring your domain’s verified digital identity. This way, your site users can feel confident they’re transacting with your legitimate site, not with an impostor.
• Securing your data in transit. This protects your customers’ sensitive data as it transmits to your server.
• Ensuring data integrity. The protocol negotiation process involves cryptographic hashing, which ensures no one tampers with your data after it has been signed.

Now that you’ve learned how to install an SSL/TLS certificate on Windows Server 2019, get your certificate and pick your preferred installation method.

• Go with the manual method if you want to have complete control over the setup process (and have loads of free time on your hands).
• Use GeoTrust Horizon AutoInstall SSL for a lightning-fast, automated certificate installation process.

Regardless of which one you choose, it’s time to boost your website’s security and customers’ trust.