Installing an SSL certificate on IIS

IIS will not read PEM. Bundle the certificate, its chain and the key into a PKCS#12 file first — the Format Converter tool here cannot do this one, because it requires encryption.

openssl pkcs12 -export -out site.pfx -inkey example.com.key -in example.com.crt -certfile intermediate.crt

Then import and bind. In the GUI: certlm.msc → Personal → Certificates → Import, then IIS Manager → Site → Bindings → Add → https. Or in PowerShell:

Import-PfxCertificate -FilePath C:\certs\site.pfx `
  -CertStoreLocation Cert:\LocalMachine\My `
  -Password (Read-Host -AsSecureString)

New-WebBinding -Name "Default Web Site" -Protocol https `
  -Port 443 -HostHeader example.com -SslFlags 1

Intermediates must land in Intermediate Certification Authorities, not Personal. If they end up in the wrong store, IIS serves the leaf alone and non-Windows clients see an incomplete chain — while Windows browsers look fine, because they fetch the missing intermediate themselves.

Verify it from the outside

A config that reloads without error can still be serving the wrong file, and your own browser will hide a missing intermediate because it caches them from other sites. Check what IIS (Windows) actually presents:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -dates

Or use the Domain SSL Checker, which performs the same handshake from this server and flags an incomplete chain explicitly.

Installing an SSL certificate on IIS

Verify it from the outside

Other platforms