Configure IIS

This document provides information on how to configure the IIS publishing profile to make it possible to install and publish certificates.

Requirements

• A certificate generated and signed by a CA. More information in How to create a request and How to sign a request.
• A credential registered in Segura® with access to the IIS server. More information in How to configure a credential in Segura®.
• A device registered in Segura® for the IIS server. More information in How to configure a device. If the device is not directly reachable from the Segura® Platform, configure a Network Connector on the device before you create the publishing profile. A Network Connector configured on the device always takes precedence over a global Network Connector.
• A WinRM connectivity on the device. Without it, the publication fails with the error Device without WinRM connectivity.
• An HTTPS binding on the IIS site, on the port you enter in the Site port field. Segura® adds the certificate to this existing binding and does not create it.

Configure IIS

To configure IIS, see the following steps:

1. On Segura®, in the navigation bar, hover over the Products menu and select Certificate Manager.
2. In the side menu, select Publishing > Publishing profiles.
3. In the actions button, select IIS.
4. In the Settings tab, enter the following information:
   1. In the Profile name *, enter the profile's name.
   2. In the Credential username, enter the credentials' name.
   3. Optional: Check the Use a registered credential to access all devices option and, in the Access credential registered in the system, select the access credential registered in Segura® to be used.
5. Click Continue.
6. In the IIS tab, enter the following fields:
   1. In the Access port WinRM field, enter the port used to connect via Windows Remote Management. Use port 5985 for WinRM HTTP, or port 5986 for WinRM HTTPS. The default is 5986. This port overrides the port of the device's WinRM connectivity.
   2. In the Site name field, enter the name of the website the SSL certificate applies to. This field is required to publish, even though the form does not mark it as required. Without it, the execution log records that the binding could not be created because the site or the port was not provided.
   3. In the Site port field, enter the port used for HTTPS connections. The default port is 443.
   4. In the Certstore name field, enter the name of the Windows certificate store where the SSL certificate will be stored. The default is MY.

7. Click Continue.
8. In the Devices tab, select the IIS server.
   1. The device must be previously registered in Segura®.
   2. The Network Connector column shows Yes or No, depending on whether the device has its own Network Connector agent configured.
9. In the Review tab, review all information entered previously, including the Network Connector column, and click Save.

Verify your results

After Segura® publishes the certificate, it uses the same Network Connector configured on the device to verify the installed certificate. The IIS plugin follows the same install-then-verify pattern as the Apache, Tomcat, and Nginx publishing profiles.

The execution logs mask the certificate content (PFX).