---
title: "Configure IIS"
slug: "clm-configure-iis"
updated: 2026-11-06T16:34:58Z
published: 2026-11-06T16:34:58Z
canonical: "docs.senhasegura.io/clm-configure-iis"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure IIS

This document provides information on how to configure the IIS publishing profile to make it possible to install and publish certificates.

## Requirements

- A certificate generated and signed by a CA. More information in [How to create a request](/v4-2/docs/certificates-flow-how-to-requisitions) and [How to sign a request](/v4-2/docs/certificates-flow-how-to-sign-request).
- A credential registered in Segura® with access to the IIS server. More information in [How to configure a credential in Segura®](/v4-2/docs/pam-credential-how-to-set-up-a-credential-in-senhasegura).
- A device registered in Segura® for the IIS server. More information in [How to configure a device](/v4-2/docs/pam-device-configure-device). If the device is not directly reachable from the Segura® Platform, configure a Network Connector on the device before you create the publishing profile. A Network Connector configured on the device always takes precedence over a global Network Connector.
- A WinRM connectivity on the device. Without it, the publication fails with the error `Device without WinRM connectivity`.
- An HTTPS binding on the IIS site, on the port you enter in the **Site port** field. Segura® adds the certificate to this existing binding and does not create it.

## Configure IIS

To configure IIS, see the following steps:

1. On Segura®, in the navigation bar, hover over the **Products** menu and select **Certificate Manager**.
2. In the side menu, select **Publishing** > **Publishing profiles**.
3. In the actions button, select **IIS**.
4. In the **Settings** tab, enter the following information:
  1. In the **Profile name ***, enter the profile's name.
  2. In the **Credential username**, enter the credentials' name.
  3. Optional: Check the **Use a registered credential to access all devices** option and, in the **Access credential registered in the system**, select the access credential registered in Segura® to be used.
5. Click **Continue**.
6. In the **IIS** tab, enter the following fields:
  1. In the **Access port WinRM** field, enter the port used to connect via Windows Remote Management. Use port 5985 for WinRM HTTP, or port 5986 for WinRM HTTPS. The default is 5986. This port overrides the port of the device's WinRM connectivity.
  2. In the **Site name** field, enter the name of the website the SSL certificate applies to. This field is required to publish, even though the form does not mark it as required. Without it, the execution log records that the binding could not be created because the site or the port was not provided.
  3. In the **Site port** field, enter the port used for HTTPS connections. The default port is 443.
  4. In the **Certstore name** field, enter the name of the Windows certificate store where the SSL certificate will be stored. The default is `MY`.

Attention

The automatic certificate publishing feature using the IIS plugin requires Windows Server 2019 or a later version. If you are using a legacy system, upgrade to version 2019 or above to ensure compatibility.

1. Click **Continue**.
2. In the **Devices** tab, select the IIS server.
  1. The device must be previously registered in Segura®.
  2. The **Network Connector** column shows **Yes** or **No**, depending on whether the device has its own Network Connector agent configured.
3. In the **Review** tab, review all information entered previously, including the **Network Connector** column, and click **Save**.

## Verify your results

After Segura® publishes the certificate, it uses the same Network Connector configured on the device to verify the installed certificate. The IIS plugin follows the same install-then-verify pattern as the Apache, Tomcat, and Nginx publishing profiles.

The execution logs mask the certificate content (PFX).