Automate certificate management for IIS servers on Windows
Use DigiCert® Trust Lifecycle Manager to automate certificate management for Microsoft Internet Information Services (IIS) web servers running on Windows. This guide describes how to set up agent-based automation and manage certificates on your IIS server.
After you install the DigiCert agent, Trust Lifecycle Manager discovers the IIS endpoints on the server. You then create a certificate profile for enrollment and configure automation to install a certificate on an unsecured endpoint or replace an existing certificate. From the inventory, you can continue to track and manage these certificates throughout their lifecycle.
Before you begin
Make sure Trust Lifecycle Manager can access the certificate authority (CA) that issues your TLS server certificates.
DigiCert-hosted Private CA is available by default.
Other CAs require a CA connector.
Ensure that the Windows server meets the system and network requirements for installing and running the DigiCert agent. IIS automation supports the default IIS versions available with supported Windows operating systems. For more details, see DigiCert agent system requirements.
(Optional) To automate domain control validation (DCV) for certificates issued from CertCentral or Let's Encrypt, configure a DNS integration to use for DNS-based challenges. For more information, see DNS integrations.
Set up agent-based automation
Install and activate the DigiCert agent, and then create a certificate profile to prepare your IIS endpoints for certificate automation.
To download the Windows agent software and generate an activation key in Trust Lifecycle Manager:
From the Trust Lifecycle Manager main menu, select Discovery & automation tools > Client tools.
Select Agent - Windows installer.
Use the download button on the right to download the latest version of the DigiCert agent installer for Windows. It should have a name like tlm_agent_N.N.N_win64.zip, where "N.N.N" is the agent version number.
To get an activation code, select the Generate activation code button under Requirements. In the popup dialog that opens:
(Optional) Select a Business unit to assign the agent to. If you make a selection here, only users assigned as administrators for that business unit can manage the agent.
(Optional) Under Share the code, select a user to send the activation code to via email. For example, select an admin who will install the agent software.
Select the Generate the code button. Copy the code so you can use it to install the agent or provide it to the person who will perform the installation.
Notice
The activation code is valid for 30 minutes and is for one-time use only. If it expires, repeat the process to generate a new one.
To install and activate the agent software on a Windows server:
Unzip the installer you downloaded and run the DigiCert TLM Agent executable as an administrator.
Select the button to Install the agent. Follow the prompts to install the agent.
When prompted, select to confirm that I have the activation code.
When prompted, select how the agent will connect to Trust Lifecycle Manager:
Direct, no proxy: If the agent will connect directly.
My own proxy server: If connecting through a third-party proxy server. You are prompted to enter the proxy server details.
DigiCert sensor as proxy: If using a DigiCert sensor as a proxy server. You are prompted to enter the sensor details.
Notice
DigiCert sensors include built-in failover support. On the agent, you only need to configure the primary sensor to use as proxy. If your network has multiple DigiCert sensors, the agent will automatically switch to a different sensor if the primary sensor proxy fails.
On the activation screen, enter the Activation code you generated. Optionally, assign a custom name to the agent to help identify it in Trust Lifecycle Manager.
On the final screen, select whether to start the agent service now. The agent service needs to be running in order to discover and automate certificates on the host.
Verify that the agent is connected to Trust Lifecycle Manager and has correctly identified the IIS endpoints you want to automate.
From the Trust Lifecycle Manager menu, select Discovery & automation tools > Agents.
Verify that the agent you installed is listed in the table.
Select the agent and verify the following:
On the General information tab, the IIS endpoint shows the correct application and application version.
On the IP/port targets tab, the application and application version for each IIS port you want to automate is accurate. If the IIS version is incorrect, edit the agent and select the application and application version for each port.
The agent is now ready to manage certificates on the IIS endpoints.
Create a certificate profile for requesting and managing certificates on IIS endpoints by using an agent.
From the Trust Lifecycle Manager main menu, go to Policies > Certificate profiles.
Select Create profile from template.
Select a base template that supports managed automation.
To find base templates that support managed automation, look for End-to-end certificate automation in the Use cases column on the Policies > Base templates page. Available templates include those in the following table.
Configure the following options in the Create certificate profile wizard.
Note
The screens and options available in the wizard depend on the certificate template you started with.
Enter a name for the profile.
Select
DigiCert agentas the enrollment method for requesting certificates from this profile.Configure the following optional settings as needed:
Select Auto-renew certificate to automatically renew certificates issued from the profile before they expire.
Assign tags and select certificate owners who should receive notifications for all certificates issued from the profile.
For more details on creating a certificate profile, see Use the profile configuration wizard.
Select Next to continue through the wizard, or select Back to return to previous screens and make changes.
Select Create to create the certificate profile.
The certificate profile is now available for certificate automation requests from your IIS endpoints.
Install a certificate on an unsecured IIS endpoint
To request and install a certificate on an unsecured IIS endpoint:
From the Trust Lifecycle Manager main menu, select Discovery & automation tools > Agents.
Select the agent that you installed from the table.
Select Unsecured IP/ports. This opens the Unsecured system view in the inventory, pre-filtered to show endpoints managed by this agent.
Find the endpoint where you want to install the certificate.
In the rightmost column of the table, select the certificate icon (Request certificate).
Complete the Automation request form:
Choose profile: Select the certificate profile that you created.
Certificate information: Enter the domain name for the certificate and configure any additional certificate options as needed.
Configure scheduling, auto-renewal, agent scripts, certificate owners, and tags as needed.
Select the checkbox at the end of the form to acknowledge acceptance of the Certificate Services Agreement.
Select Submit.
The certificate is issued and installed on the IIS endpoint.
Replace the existing certificate on an IIS endpoint
To replace an existing certificate on an IIS endpoint:
From the Trust Lifecycle Manager main menu, select Discovery & automation tools > Agents.
Select the agent that you installed from the table.
Select Managed certificates. This opens the Automated system view in the inventory, pre-filtered to show endpoints managed by this agent.
Find the endpoint where you want to replace the existing certificate.
In the rightmost column of the table, select the certificate icon (Request certificate).
Complete the Automation request form:
Choose profile: Select the certificate profile that you created.
Certificate information: Enter the domain name for the certificate and configure any additional certificate options as needed.
Configure scheduling, auto-renewal, agent scripts, certificate owners, and tags as needed.
Select the checkbox at the end of the form to acknowledge acceptance of the Certificate Services Agreement.
Select Submit.
The new certificate is issued and installed on the IIS endpoint, replacing the existing certificate.
Note
You can follow the same workflow to perform other certificate management actions, such as renewing or reissuing a certificate. For details, see Manage endpoints.