How to assign a SSL Certificate to IIS7 Site from Command Prompt

IisIis 7SslSsl CertificateAppcmd

Iis Problem Overview

Can you advise me whether it is possible or not to assign a SSL Certificate to a website in IIS7 using the APPCMD application?

I am familiar with the command to set the HTTPS Binding

appcmd set site /"A Site" /+bindings.[protocol='https',bindingInformation='*']

and how to obtain current mappings


but can not seem to find any way to map a site to a certificate (say the certificates hash for example)

Iis Solutions

Solution 1 - Iis

The answer is to use NETSH. For example

netsh http add sslcert ipport= certhash='baf9926b466e8565217b5e6287c97973dcd54874' appid='{ab3c58f7-8316-42e3-bc6e-771d4ce4b201}'

Solution 2 - Iis

This helped me a lot: a simple guide, by Sukesh Ashok Kumar, to setting up SSL for IIS from the command line. Includes importing/generating the certificate with certutil / makecert.

EDIT: if the original URL is down, it's still available through the Wayback Machine.

Solution 3 - Iis

With PowerShell and the WebAdministration module, you can do the following to assign an SSL certificate to an IIS site:

# ensure you have the IIS module imported
Import-Module WebAdministration

cd IIS:\SslBindings
Get-Item cert:\LocalMachine\My\7ABF581E134280162AFFFC81E62011787B3B19B5 | New-Item!443

Things to note... the value, "7ABF581E134280162AFFFC81E62011787B3B19B5" is the thumbprint for the certificate you want to import. So it needs to be imported into the certificate store first. The New-Item cmdlet takes in the IP address ( for all IPs) and the port.

See for more details.

I've tested this in Windows Server 2008 R2 as well as Windows Server 2012 pre-release.

Solution 4 - Iis

@David and @orip have it right.

However, I did want to mention that the ipport parameter specified in the example ( is what the MSDN calls the "unspecified address (IPv4: or IPv6: [::])".

I went looking it up, so I figured I'd document here to save someone else the time. This article focuses on SQL Server, but the information is still relevant:

Solution 5 - Iis

Using the answers from this post, I created a single script that did the trick for me. It starts from the pfx file, but you could skip that step.

Here it is:

cd C:\Windows\System32\inetsrv

certutil -f -p "pa$$word" -importpfx "C:\temp\mycert.pfx"

REM The thumbprint is gained by installing the certificate, going to cert manager > personal, clicking on it, then getting the Thumbprint.
REM Be careful copying the thumbprint. It can add hidden characters, esp at the front.
REM appid can be any valid guid
netsh http add sslcert ipport= certhash=5de934dc39cme0234098234098dd111111111115 appid={75B2A5EC-5FD8-4B89-A29F-E5D038D5E289}

REM bind to all ip's with no domain. There are plenty of examples with domain binding on the web
appcmd set site "Default Web Site" /+bindings.[protocol='https',bindingInformation='*:443:']

Solution 6 - Iis

If you're trying to perform IIS Administration without using the MMC snap-in GUI, you should use the powershell WebAdministration module.

The other answers on this blog don't work on later versions of Windows Server (2012)

Solution 7 - Iis

Using PowerShell + netsh:

$certificateName = ''
$thumbprint = Get-ChildItem -path cert:\LocalMachine\My | where { $_.Subject.StartsWith("CN=$certificateName") } | Select-Object -Expand Thumbprint
$guid = [guid]::NewGuid().ToString("B")
netsh http add sslcert ipport="" certhash=$thumbprint certstorename=MY appid="$guid"

If you need a named binding, replace netsh call with this:

netsh http add sslcert hostnameport="$certificateName:443" certhash=$thumbprint certstorename=MY appid="$guid"

Solution 8 - Iis

With IISAdministration ( you can use the following code to add a new HTTPS binding to a specific site:

$thumbPrint = (gci Cert:\localmachine\My | Where-Object { $_.Subject -Like "certSubject*" }).Thumbprint
New-IISSiteBinding -Name "Site Name" -BindingInformation "*:443:" -CertificateThumbPrint $thumbPrint -CertStoreLocation My -Protocol https

View existing bindings with

Get-IISSiteBinding -Name "Site Name"

Remove an existing binding with

Remove-IISSiteBinding -Name "Site Name" -BindingInformation "*:443:" -Protocol https -Confirm:$False


All content for this solution is sourced from the original question on Stackoverflow.

The content on this page is licensed under the Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) license.

Content TypeOriginal AuthorOriginal Content on Stackoverflow
QuestionDavid ChristiansenView Question on Stackoverflow
Solution 1 - IisDavid ChristiansenView Answer on Stackoverflow
Solution 2 - IisoripView Answer on Stackoverflow
Solution 3 - IisDavid MohundroView Answer on Stackoverflow
Solution 4 - IisfordarehView Answer on Stackoverflow
Solution 5 - IisJsAndDotNetView Answer on Stackoverflow
Solution 6 - IisDevOps ScottView Answer on Stackoverflow
Solution 7 - IisSergey NudnovView Answer on Stackoverflow
Solution 8 - IisjansohnView Answer on Stackoverflow