Microsoft IIS

Windows · Web server

Installs and binds certificates on IIS websites and FTP sites.

What happens

The service agent on the server fetches the task from the appliance over outbound HTTPS, port 443.
The Windows basics first import the certificate into the Windows certificate store (LocalMachine\My).
HTTPS and FTP bindings that carried the previous certificate switch to the new one. The first time, or when the rule does not follow the previous certificate, only the rule's own bindings change. If it fails: If the change does not read back correctly, the installation reverses it itself, and the result says whether that worked. If it fails before that, nothing is written.
Verification: the package reads back IIS bindings, the certificate store and HTTP.sys, and tests HTTPS with fresh TLS connections, host names and certificate chains. FTP is checked in configuration.

Connection: The package runs through the service agent on the server. The agent connects over outbound HTTPS to the appliance, port 443 by default. You open no port into the server.
Service ports: 443
You need: The service agent installed on the server.
Platform: IIS 8.0 and later, Windows Server 2012 and later
Actions: Discovery, Installation, Verification, Rollback, Removal
Packages: iis8plus 1.3.1
Note: Rollback restores the recorded bindings that still use the deployment certificate. Later changes are preserved and incomplete restoration is reported.
The certificate chain travels with the deployment. If an intermediate certificate is missing from the machine CA store, the package imports it before the bindings switch. If the chain cannot be built to a trusted root, nothing switches.
Discovery finds websites, FTP sites and certificates in the My and WebHosting stores. It shows HTTP.sys registrations, shared bindings, Central Certificate Store and the IIS Management Service certificate. TLS checks run during deployment and verification.