>
    Strata Copilot
    Provision to Microsoft IIS
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security Overview
    5. Welcome to Installations
    6. About Machines
    7. Create a Microsoft IIS Machine
    8. Provision to Microsoft IIS
    Next‑Gen Trust Security

    Provision to Microsoft IIS

    Table of Contents

    Provision to Microsoft IIS

    Provision a certificate from Next-Gen Trust Security to a Windows server that runs Microsoft Internet Information Services (IIS). Next-Gen Trust Security installs the certificate in the certificate store you choose, and it can also bind the certificate to an IIS web site.

    Before You Begin

    • A Microsoft IIS machine that you created and whose status is Verified.
    • The certificate to provision in the Next-Gen Trust Security inventory, with its private key.
    • A Superuser role or a custom role with write access to the Provisioning permission set, which is under the Machines permission set.
    • IIS 10.0 or later on the server, with the WebAdministration PowerShell module.
    • To bind the certificate, the name of an IIS web site that already exists on the server.

    To Provision a Certificate to Microsoft IIS

    1. Sign in to Next-Gen Trust Security.
    2. Click Insights > Certificate Installations > Machines.
    3. Click the more options button at the end of the machine's row, and then select Provision.
    4. In Search a certificate by name, expiration or fingerprint, enter part of the certificate's name, expiration date, or fingerprint, and then select the certificate from the results. Confirm that it's the right certificate by checking Subject DN, Validity, and Certificate SHA1 Fingerprint.
      The rest of the Provision a certificate dialog appears after you select a certificate.
    5. Under Certificate Information, for CAPI Store, choose the certificate store under the server's local computer account: Personal or Web Hosting.
    6. In Friendly Name, enter the name the certificate shows in Windows and IIS. You can use letters, numbers, spaces, hyphens (-), underscores (_), periods (.), asterisks (*), and parentheses.
    7. (Optional) To let the private key be exported from the server after installation, enable Allow Private Key to be Exported. By default, the private key isn't exportable.
    8. (Optional) To bind the certificate to an IIS web site, under Installation Endpoint, enable Bind Certificate to IIS Web Site. The binding fields appear.
    9. If you enabled the binding, in IIS Web Site Name, enter the name of the IIS web site.
    10. (Optional) To create an HTTPS binding on the web site if a matching one doesn't exist, enable Create Binding if not found.
      Note: If no binding matches and this option is disabled, Next-Gen Trust Security still installs the certificate in the certificate store, but provisioning fails.
    11. (Optional) In Binding IP Address, enter the IPv4 address of the binding. The default, 0.0.0.0, binds to all unassigned addresses.
    12. (Optional) In Binding Port, replace the default, 443, if the binding uses a different port.
    13. (Optional) In Binding Hostname, enter the host name of the binding.
    14. (Optional) To turn on Server Name Indication (SNI) for the binding, enable Require Server Name Indication. This option requires Binding Hostname.
      Note: Without SNI, the binding is matched by IP address and port. If another web site already uses that IP address and port, provisioning fails.
    15. (Optional) To stop and start the web site after the binding changes, enable Restart the IIS Web Site.
    16. (Optional) To save the installation without pushing the certificate now, disable Push certificate on save.
    17. Click Save. To save and then provision another certificate, click Save & New.
    After you save, an installation appears on the machine's Installations tab. Next-Gen Trust Security installs the certificate in the store you chose and its issuing chain in the server's intermediate and trusted root certificate stores. If the certificate is already in the store, Next-Gen Trust Security updates its friendly name. If you enabled the binding, Next-Gen Trust Security then updates or creates the web site's HTTPS binding to use the certificate. To provision on a schedule instead of right away, set up a machine provisioning schedule.

    © 2026 Palo Alto Networks, Inc. All rights reserved.