How do I install an SSL/TLS certificate on my Amazon EC2 Windows instance that runs on an IIS server?

Resolution

Note: If you use Elastic Load Balancing (ELB), then you can use an Amazon issued certificate from AWS Certificate Manager (ACM).

To install an SSL/TLS certificate on your Windows instance, complete the following steps.

Create a CSR and request an SSL/TLS certificate

Complete the following steps:

1. Choose Start, and then choose Internet Information Services (IIS) Manager.
2. For Connections, select the server where you want to install the certificate.
3. Under IIS, choose Server Certificates.
4. Under Actions, choose Create Certificate Request.
5. For Request Certificate, configure the following settings:
   For Common name, enter the fully qualified domain name (FQDN), such as www.example.com.
   For Organization, enter your company's name.
   (Optional) For Organizational unit, enter the name of the department within your organization.
   For City/locality, enter the city where the company is legally located.
   For State/province, enter the state or province where the company is legally located.
   For Country, enter the country where the company is legally located.
6. Choose Next.
7. For Cryptographic Service Provider Properties, configure the following settings:
   For Cryptographic service provider, select a provider.
   For Bit length, select 2048.
   Note: It's a best practice to use 2048 to balance security, latency, and CPU usage.
8. Choose Next.
9. For File Name, navigate to the location where you want to save the certificate signing request (CSR).
   Note: If you don't specify a location, then Windows saves the file to C:\windows\system32 or ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools.
10. Choose Finish.
11. Use a text editor to copy the text from the file.
    Example text:
    -----BEGIN NEW CERTIFICATE REQUEST-----examplekey-----END NEW CERTIFICATE REQUEST-----
12. Send the text, with the first and last lines, to your certificate provider so that they can issue the certificate.

Install your SSL/TLS certificate

Complete the following steps:

1. Save the certificate file that your provider issued to the server where you created the CSR.
2. Choose Start, and then choose Internet Information Services (IIS) Manager.
3. For Connections, choose the name of the server where you want to install the certificate.
4. Under IIS, choose Server Certificates.
5. Under Actions, choose Complete Certificate Request.
6. For Specify Certificate Authority Response, configure the following settings:
   For File name containing the certificate authority's response, select the certificate (.cer) file.
   For Friendly name, enter a name for you to identify the certificate.
   For Select a certificate store for the new certificate, select Web Hosting.
7. Choose OK.

Assign the SSL/TLS certificate to your IIS deployment

Complete the following steps:

1. Choose Start, and then choose Internet Information Services (IIS) Manager.
2. For Connections, choose the name of the server where you installed your certificate.
3. Select Sites to expand the section, and then choose the site where you want to assign the certificate.
4. Under Actions, choose Bindings.
5. In the Site Bindings pop-up box, choose Add.
   Note: To modify an existing SSL/TLS certificate that's assigned to a site, choose the HTTPS binding, and then choose Edit. In the SSL certificate dropdown list, select the certificate, and then choose OK.
6. For Add Site Binding, configure the following settings:
   For Type, select HTTPS.
   For IP Address, select the IP address of the site, or select All Unassigned.
   For Port, enter 443.
   Note: HTTPS uses port 443 for SSL/TLS secured traffic.
   For SSL Certificate, select the SSL certificate for the site, such as www.example.com.
7. Choose OK.