IIS 8–10: PFX Certificate Import

Overview

This guide demonstrates how to import an SSL certificate from a PFX file (PKCS#12) into IIS 8, 8.5, or 10. PFX files are used when the certificate was created via the FairSSL CSR service, exported from another server, or restored from a backup.

Supported versions

IIS Version	Windows Server
IIS 8.0	Windows Server 2012
IIS 8.5	Windows Server 2012 R2
IIS 10.0	Windows Server 2016, 2019, 2022, 2025

Prerequisites

Administrator access to the server
A PFX file and its password (if using the FairSSL CSR service, this is received via SMS)

Method 1 – Import via MMC (All versions)

Save the PFX file in a convenient location, such as the desktop.
Press Windows + R, type mmc.exe and click OK.
Select File → Add/Remove Snap-in.
Select Certificates, click Add, then select Computer account → Local computer. Click Finish and then OK.
Expand Certificates (Local Computer) → Personal.
Right-click Personal → All Tasks → Import.
Click Browse and change the file format filter to Personal Information Exchange (*.pfx;*.p12) in the bottom-right corner.
Select your PFX file and click Open, then Next.
Enter the PFX file password. Tick Mark this key as exportable if you want to be able to export the certificate again later.
Select Automatically select the certificate store based on the type of certificate.
Click Next and then Finish.

[Screenshot: MMC → Personal → All Tasks → Import → PFX]

Method 2 – Import via certlm.msc (Windows Server 2012+)

A quicker method for newer Windows Server versions:

Press Windows + R, type certlm.msc and press Enter.
Expand Personal and right-click on Certificates.
Select All Tasks → Import.
Follow the wizard: select the PFX file, enter the password, tick Mark this key as exportable and finish.

Method 3 – Import via PowerShell

$password = ConvertTo-SecureString -String "DitPassword" -AsPlainText -Force
Import-PfxCertificate -FilePath "C:\certifikat.pfx" -CertStoreLocation Cert:\LocalMachine\My -Password $password -Exportable

Assigning the certificate to a website

After the import is complete, the certificate must be bound to the relevant IIS website:

Open IIS Manager (inetmgr).
Select the website under Sites in the left-hand panel.
Click Bindings in the right-hand panel.
Click Add (or Edit for an existing HTTPS binding).
Select Type: https, set Port: 443, and select the imported certificate from the SSL certificate dropdown.
Click OK and then Close.

[Screenshot: IIS Manager → Site Bindings → Select imported certificate]

Troubleshooting

"The password is not correct": PFX passwords are case-sensitive. Verify that you are using the correct credentials.
The certificate appears in MMC but not in IIS Manager: Restart IIS using iisreset or ensure the certificate was imported into the Local Computer store (not Current User).
Key icon missing (certificate without private key): The PFX file was either corrupted or did not include the private key. Please use the original PFX file.

Certificates on many servers and appliances

A publicly trusted SSL certificate can be valid for at most 199 days now, 99 days by 15 March 2027 and 46 days by 15 March 2029. Each certificate then has to be replaced at least twice a year now and at least eight times a year from 2029, on every server, firewall and load balancer that uses it. sslbrain from FairSSL runs as an appliance in your own network and renews and installs the certificates from one place, including on devices without an agent.

How sslbrain renews and installs certificates on IIS