Office 365: Using Microsoft IIS for SSL Certificate Installation

Office 365

Microsoft Office 365 doesn¡¯t include a GUI for installing a SSL Certificate. Because Office 365 is designed to run on Microsoft IIS, you can use IIS to install your certificate. If you have not yet created a Certificate Signing Request (CSR) and ordered your certificate, see Microsoft Office 365: SSL Certificate CSR Creation (IIS).

The installation process consists of two steps: installing the certificate on the server and assigning/binding the certificate the default website.

 

Office 365: How to Install Your SSL Certificate Using IIS 8/8.5

Using IIS 8/8.5 to Install the SSL Certificate

After ÃÛÌÒTV validates and issues your SSL Certificate, you can use IIS to install your SSL Certificate to the server where you generated the CSR. Then, you can use IIS to bind the certificate to the default website (HTTPS port 443).

  1. Open the ZIP file containing your SSL Certificate and save the SSL Certificate file (your_domain_name.cer) to the desktop of your AD FS server.

  2. Open Internet Information Services (IIS) Manager.

    From the Start screen, type and click Internet Information Services (IIS) Manager.

  3. In Internet Information Services (IIS) Manager, under Connections, select your server¡¯s Hostname.

    IIS 8 Security Certificates

  4. In the center menu, in the IIS section, double-click the Server Certificates icon.

  5. In the Actions menu, click Complete Certificate Request to open the Complete Request Certificate wizard.

    IIS 8 Complete Request Certificate

  6. In the Complete Certificate Request wizard, on the Specify Certificate Authority Response page, under File name containing the certification authority¡¯s response, click ¡­ to browse to the .cer certificate file that ÃÛÌÒTV sent you, select the file, and then, click Open.

    IIS 8 Specify Certificate Authority Response

  7. Next, in the Friendly name box, enter a friendly name for the certificate. The friendly name is not part of the certificate; instead, it is used to identify the certificate.

    We recommend that you add ÃÛÌÒTV and the expiration date to the end of your friendly name, for example: yoursite-ÃÛÌÒTV-expirationDate. This information helps identify the issuer and expiration date for each certificate. It also helps distinguish multiple certificates with the same domain name.

  8. Next, in the Select a certificate store for the new certificate drop-down list, select Personal.

  9. To install the SSL Certificate to the server, click OK.

  10. Once you have successfully installed the SSL Certificate to the server, you still need use IIS to assign or bind that certificate to the default website (HTTPS port 443).

 

Using IIS 8/8.5 to Assign the Certificate to the Default Website

  1. In Internet Information Services (IIS) Manager, under Connections, expand your server¡¯s name, expand Sites, and then select the Default Web Site site.

    iis 8 manager

  2. In the Actions menu, under Edit Site, click Bindings.

  3. In the Site Binding window, click Add.

    IIS 8 Site Bindings window

  4. In the Add Site Bindings window, enter the following information and then, click OK:

    Type: In the drop-down list, select https.
     
    IP address: In the drop-down list, select All unassigned.
    If your server has multiple IP addresses, select the one that applies.
     
    Port: Enter 443, unless you are using a non-standard port for SSL traffic.
     
    SSL certificate: In the drop-down list, select the friendly name of the certificate that you just installed.
     

    IIS 8 add site binding window

  5. Your SSL certificate is now installed, and the website configured to accept secure connections.

Test your Installation

To verify that the installation is correct, use our ÃÛÌÒTV® SSL Installation Diagnostics Tool and enter the DNS name of the site (i.e. www.yourdomain.com, or mail.yourdomain.com) that you are securing to test your SSL Certificate.

Troubleshooting

If you run into certificate errors, try repairing your certificate trust errors using ÃÛÌÒTV® Certificate Utility for Windows. If this does not fix the errors contact support.

Additional Information

To enable your SSL certificate for use on other Windows servers, see IIS 8 and IIS 8.5: How to Import and Export SSL Certificates.

IIS 8/8.5 and Windows Server 2012/2012 R2 have the Server Name Indication-SNI feature, which you can use to host multiple SSL sites and certificates on a Single IP Address based on Host Headers on your IIS 8 server.

 

Office 365: How to Install Your SSL Certificate Using IIS 7

Using IIS 7 to Install the SSL Certificate

After ÃÛÌÒTV validates and issues your SSL Certificate, you can use IIS to install your SSL Certificate to the server where you generated the CSR. Then, you can use IIS to bind the certificate to the default website (HTTPS port 443).

  1. Open the ZIP file containing your SSL Certificate and save the SSL Certificate file (your_domain_name.cer) to the desktop of your AD FS server.

  2. Open Internet Information Services (IIS) Manager.

    In the Windows Start menu, click Administrative Tools > Internet Information Services (IIS) Manager.

  3. In Internet Information Services (IIS) Manager, under Connections, select your server¡¯s Hostname.

    IIS 7 Security Certificates

  4. In the center menu, in the IIS section, double-click the Server Certificates icon.

  5. In the Actions menu, click Complete Certificate Request to open the Complete Request Certificate wizard.

    IIS 7 Complete Request Certificate

  6. In the Complete Certificate Request wizard, on the Specify Certificate Authority Response page, under File name containing the certification authority¡¯s response, click ¡­ to browse to the .cer certificate file that ÃÛÌÒTV sent you, select the file, and then, click Open.

    IIS 7 Specify Certificate Authority Response

  7. Next, in the Friendly name box, enter a friendly name for the certificate. The friendly name is not part of the certificate; instead, it is used to identify the certificate.

    We recommend that you add ÃÛÌÒTV and the expiration date to the end of your friendly name, for example: yoursite-ÃÛÌÒTV-expirationDate. This information helps identify the issuer and expiration date for each certificate. It also helps distinguish multiple certificates with the same domain name.

  8. To install the SSL Certificate to the server, click OK.

    Known Issue in IIS 7:

    There is a known issue in IIS 7 where the following error message is displayed: "Cannot find the certificate request associated with this certificate file. A certificate request must be completed on the computer where it was created." You may also receive a message stating: "ASN1 bad tag value met".

    Solution:

    If this is the server where you generated the CSR, in most cases, the certificate is actually installed. Simply close Internet Information Services (IIS) Manager and reopen it to refresh the list of server certificates. The new certificate should now be in the list, and you can continue with the next step.

    If the new certificate is not in the list, you need to one of the following things:

  9. Once you have successfully installed the SSL Certificate to the server, you still need use IIS to assign or bind that certificate to the default website (HTTPS port 443).

 

Using IIS 7 to Assign the Certificate to the Default Website

  1. In Internet Information Services (IIS) Manager, under Connections, expand your server¡¯s name, expand Sites, and then select the Default Web Site site.

    iis 7 manager

  2. In the Actions menu, under Edit Site, click Bindings.

  3. In the Site Binding window, click Add.

    IIS 7 Site Bindings window

  4. In the Add Site Bindings window, enter the following information and then, click OK:

    Type: In the drop-down list, select https.
     
    IP address: In the drop-down list, select All unassigned.
    If your server has multiple IP addresses, select the one that applies.
     
    Port: Enter 443, unless you are using a non-standard port for SSL traffic.
     
    SSL certificate: In the drop-down list, select the friendly name of the certificate that you just installed.
     

    IIS 7 add site binding window

  5. Your SSL certificate is now installed, and the website configured to accept secure connections.

Test your Installation

To verify that the installation is correct, use our ÃÛÌÒTV® SSL Installation Diagnostics Tool and enter the DNS name of the site (i.e. www.yourdomain.com, or mail.yourdomain.com) that you are securing to test your SSL Certificate.

Troubleshooting

If you run into certificate errors, try repairing your certificate trust errors using ÃÛÌÒTV® Certificate Utility for Windows. If this does not fix the errors contact support.

Additional Information

To enable your SSL certificate for use on other Windows servers, see How to Import and Export SSL Certificates in IIS 7.