Skip to content
Docs sslbrain sslbrain.com

Windows basics

Copy link to the page “Windows basics”

← All integrations

Windows · Basics

Certificate Store import and discovery, IIS Central Certificate Store and PFX, PEM, DER and JKS files on Windows servers.

The service agent on the server fetches the task from the appliance over outbound HTTPS on port 443 and installs the certificate locally on the server. The appliance never connects to the server.

What happens

  1. The service agent on the server fetches the task from the appliance over outbound HTTPS, port 443.
  2. The certificate is installed where the rule says: in the Windows certificate store, in the IIS Central Certificate Store or as a PFX, PEM, DER or JKS file.
  3. Product integrations such as IIS, RDP and AD FS bind the certificate imported into the store.
  4. Verification: the package reads the certificate in the store or files and checks identity and expiry. Store import requires a usable key; PFX and JKS open with their password. DER contains the certificate and intermediates.

Technical details

Connection
The package runs through the service agent on the server. The agent connects over outbound HTTPS to the appliance, port 443 by default. You open no port into the server.
You need
The service agent installed on the server.
Platform
Windows Server 2012 and later, Windows 10 and 11
Actions
Discovery, Installation, Verification, Removal
Packages
windows-cert-install 1.3.0 windows-os
Note
  • windows-cert-install imports into the store, CCS or six file layouts: PFX, JKS, separate PEM, PEM key plus chain, one PEM file or DER. It can grant read access to up to 16 accounts and restart selected services. JKS uses the same password for store and key.
  • windows-os on Windows Server 2012 R2 and later discovers services, certificates and TLS configuration and can export a certificate with an exportable private key from LocalMachine as PFX. It does not install, bind or verify certificates and has no rollback action.
  • Windows certificate import has no separate rollback action. If a later step in the same deployment fails, it restores the files it wrote and removes the certificates it added. If a selected service restart fails, file access rules are restored and services are started again; services stopped before the run are stopped again.
  • A certificate already in the store with a readable key is not imported again. Services that were given access to its key keep it.
  • The IIS Central Certificate Store must be set up in IIS. The PFX files are named after the certificate's host names.
  • Windows certificate import discovery reads the certificate store. Windows inventory finds services and TLS configuration on the server.

Get started