Reinstalling New SSL Certificate in IIS

12/03/2025 10:20 am EST

Log into Web/Domain/Certificate Provider and download the newest certificate pfx preferred or you can generate from the web machine you created the RSA token from
Copy the certificate files onto the server where IIS is installed
On the IIS Server, type Windows + R:

Run Type the name of a program, folder, document, or Internet resource, and Windows will open it for you. Open:

Type in mmc and hit Enter
Go to File -> Add/Remove Snap-in
Select Certificates, then click Add>:

Select Computer Account then click Next>.
Select Local Computer then click Finish.
Click OK and Right-click on Intermediate Certification Authority->All Tasks->Import

Click Next
Next to File Name, click Browse and Navigate to the file path where you copied the downloaded certificate files
Select the file with the .p7b extension and Click Next
Make sure the radio button is checked for "Place all certificates in the following store" and that "Intermediate Certificate Authorities" is selected:

Certificate Import Wizard C«tifiGte Certficate stores are system areas where certficates are kept. Windows can automabcally select a certficate store, or you can specify a location for the certficate. O Automabcally select the certficate store based on the type of certficate @ Place all certficates n the following store Certficate store: Intermediate Certficabon Authorites

Click Next and Click Finish.
Right-click on Personal, go to All Tasks -> Import:

Console Root v Certificates (Local Computer) Object Type Certificates Personal Cert Trusted Enterpris Interme Cert Cert Trusted Untruste Third-Pa Trusted Client A Find Certificates... All Tasks New Window from Here New Taskpad View... Refresh Export List... Help Find Certificates... Request New Certificate... 1m portm Advanced Operations

Click Next.
Next to File Name, click Browse and Navigate to the file path where you copied the downloaded certificate files.
Select the file with the .crt extension and Click Next.
Make sure the radio button is enabled for "Place all certificates in the following store" and that "Personal" is selected:

Certificate Import Wizard C«tifiGte Cert ficate stores are system areas where cert ficates are kept. Windows can automabcally select a certficate store, or you can specify a location for the certificate. C) Automabcally select the certficate store based on the type of certficate @Place all certficates in the following store Cert ficate store: P sonal Cancel

Click Next, click Finish.
Under Personal, navigate down to Certificates, and in the middle pane, right-click on the new certificate and click Open:

Click on the Details and Copy the serial number.
Open an elevated command prompt and Run the command certutil - repairstore my <Serial # > and press Enter.

You should get a result like this:

Once completed, edit the binding to use the newly added Certificate.
Export and apply password if needed for .pfx file. If you have a requirement to use a jks key, you can convert the pfx key (optional)

[Optional] To convert the exported pfx to jks format, we need to use the java keytool command on the TSP Server.

Locate keytool.exe. and then past the following command into an elevated command prompt with the proper paths
"C:\Program Files (x86)\TSplus\Java\bin\keytool.exe" -importkeystore -srckeystore c:\Temp\cert.pfx -destkeystore c:\Temp\cert.jks
Place new cert.jks file in C:\Program Files (x86)\TSplus\Clients\webserver replacing the old one
To ensure propagation, restart the web server when convenient in TSPlus.

[This will kick everyone off the server for a few minutes]

Was this article helpful?