How to Generate a CSR in IIS

This guide shows you how to generate a CSR (Certificate Signing Request) on Microsoft IIS (Internet Information Services) on Windows Server. You can build the request two ways: through the IIS Manager GUI (the classic point-and-click wizard), or with certreq.exe and an INF file from PowerShell. Both keep the private key on the server in the Windows certificate store and produce a PKCS #10 request you submit to your Certificate Authority.

One important caveat to know up front: the IIS Manager wizard does not add a Subject Alternative Name (SAN) to the request, and every public CA now requires the hostname to appear in the SAN, not just in the Common Name. If you need a SAN (and you almost always do), use the certreq.exe method further down, or generate the CSR off-server with our CSR Generator and import the issued certificate as a .pfx file.

Sign in as Administrator on the Windows Server you want to secure (or to a workstation that runs an IIS site), then follow the section that matches your version of IIS. The steps below cover IIS 10 on Windows Server 2025, 2022, 2019, and 2016 (also IIS 10 on Windows 10 and Windows 11 client), and the older IIS 8 / 8.5 / 7 / 6 wizards for legacy infrastructure.

Generate a CSR on IIS 10 (Windows Server 2016 to 2025)

IIS 10 is the version that ships with Windows Server 2016, 2019, 2022, and 2025, as well as the IIS feature on Windows 10 and Windows 11 client. The Manager interface is the same on every release.

Step 1: Open IIS Manager

• Press Win + R, type inetmgr, and press Enter, or
• Open the Start menu and search for Internet Information Services (IIS) Manager.

Step 2: Open Server Certificates

• In the Connections panel on the left, click the server name.
• In the center pane (Home), double-click Server Certificates.

Step 3: Start the certificate request

In the Actions panel on the right, click Create Certificate Request. The Distinguished Name Properties dialog opens.

Step 4: Fill in the Distinguished Name

Enter the subject details below. Use only standard ASCII characters; non-Latin letters break the request:

• Common Name: the fully qualified domain name (FQDN) you want to secure, for example www.example.com. For a wildcard certificate, put an asterisk in front of the apex domain, for example *.example.com.
• Organization: the full legal name of your company, exactly as registered. Required for OV and EV certificates. For Domain Validation (DV) certificates, this field is ignored, so any short placeholder works.
• Organizational unit: a department label such as IT or Web. This attribute is deprecated for public certificates (the CA/Browser Forum has phased it out), so leave it minimal or skip it where the dialog allows.
• City/locality: the city where your organization is registered, written in full (for example Seattle, not SEA).
• State/province: the full state or province name (for example Washington, not WA).
• Country/region: the two-letter ISO country code (for example US, GB, DE).

Verify every field and click Next.

Step 5: Choose the Cryptographic Service Provider and key length

In the Cryptographic Service Provider Properties dialog:

• Cryptographic service provider: select Microsoft RSA SChannel Cryptographic Provider. This is the right choice for an RSA certificate served by IIS over HTTPS. (Choose Microsoft DH SChannel Cryptographic Provider only for the rare case you need a Diffie-Hellman key, which is not used for normal web TLS.)
• Bit length: select 2048. This is the current minimum every public CA accepts. Pick 3072 or 4096 only if your policy requires a larger key; the trade-off is slightly slower TLS handshakes.

Click Next.

Step 6: Save the CSR file

In the File Name dialog, click the browse button and pick a folder you can find again, then type a file name with a .txt extension, for example certreq.txt. Do not accept the default path C:\Windows\System32: that folder is awkward to browse and you may not have write permission depending on UAC. The Desktop or a dedicated C:\certs\ folder works better.

Click Finish. IIS writes the CSR to the path you chose and stores the matching private key as a pending request in the Windows certificate store on this server.

Step 7: Copy the CSR and submit it to the CA

Open the saved file in Notepad (or any text editor). You will see a block like this:

-----BEGIN NEW CERTIFICATE REQUEST-----
MIIDXjCCAkYCAQAwgZQxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApXYXNoaW5ndG9u
... (many lines of base64) ...
-----END NEW CERTIFICATE REQUEST-----

Select the entire block, including the BEGIN NEW CERTIFICATE REQUEST and END NEW CERTIFICATE REQUEST lines, copy it, and paste it into the CSR field on your order form. When the CA validates the request and issues your certificate, follow how to install an SSL certificate on IIS and use Complete Certificate Request to pair the issued .cer file with the pending key on this server.

The IIS Manager wizard does not add a SAN

The wizard above produces a request whose only hostname is the Common Name. Modern browsers and clients (Chromium, Firefox, Safari, .NET, Java, Go) only validate the hostname against the Subject Alternative Name extension; the Common Name has been ignored for trust decisions since 2017. Public CAs respond by copying the CN into a SAN entry automatically for single-name orders, so a CN-only request still works for one hostname. But:

• If you need multiple hostnames on one certificate (for example example.com and www.example.com, or a multi-domain certificate), the IIS Manager wizard cannot encode them.
• If your CA accepts requests strictly as-submitted, a missing SAN can be rejected even for a single hostname.

For anything beyond a single name, use the certreq.exe method below, or generate the CSR with our CSR Generator and import the issued certificate to IIS as a .pfx.

Generate a CSR with certreq.exe and an INF file (SAN-capable)

The certreq.exe command-line tool ships with every Windows Server and lets you specify a SAN, the key length, the exact subject, and the provider. The flow has three parts: write a request INF file, run certreq -new to generate the CSR (and the matching key in the Windows store), then submit the CSR to your CA.

Step 1: Create the request INF file

Open Notepad as Administrator and save the file below as request.inf. Edit the Subject line and the DNS entries under [Extensions] to match your domain:

[Version]
Signature="$Windows NT$"

[NewRequest]
Subject = "CN=www.example.com, O=Example Inc, L=Seattle, S=Washington, C=US"
KeySpec = 1
KeyLength = 2048
Exportable = TRUE
MachineKeySet = TRUE
SMIME = FALSE
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0

[EnhancedKeyUsageExtension]
OID = 1.3.6.1.5.5.7.3.1

[Extensions]
2.5.29.17 = "{text}"
_continue_ = "dns=www.example.com&"
_continue_ = "dns=example.com"

Notes on the values:

• Subject: a single line, fields separated by commas. Use the two-letter ISO country code in C=.
• KeyLength: 2048 minimum. Set 3072 or 4096 if your policy requires it.
• Exportable = TRUE: lets you export the private key with the issued certificate (for backup or for installing on a second server). Set to FALSE if you want the key locked to this machine.
• MachineKeySet = TRUE: stores the key in the Local Computer store (where IIS reads from). Leave this on for IIS.
• 2.5.29.17: the OID for Subject Alternative Name. Add one _continue_ line per hostname; every line except the last must end with the & separator.

Step 2: Generate the CSR

Open an elevated Command Prompt or PowerShell in the folder that contains request.inf and run:

certreq -new request.inf certreq.txt

certreq generates the private key in the Local Computer store and writes the PKCS #10 request to certreq.txt. Open the file, copy the full BEGIN NEW CERTIFICATE REQUEST to END NEW CERTIFICATE REQUEST block, and submit it on your order form, the same way as the IIS Manager method.

When the CA returns the issued certificate, complete it with:

certreq -accept certnew.cer

This pairs the issued certificate with the private key that has been waiting in the store, and the certificate becomes available to bind in IIS.

Check the CSR before you submit it (optional)

It is worth confirming the Common Name, SAN entries, and key size before sending the request to your CA. On the server, the built-in certutil tool reads the request:

certutil -dump certreq.txt

If you have OpenSSL installed (Windows does not ship it; you can install it separately from a build such as Shining Light Productions), this command prints the same details:

openssl req -noout -text -in certreq.txt

Prefer an online tool? Paste the contents of the request into SSL Dragon’s CSR decoder to read back the Common Name, SAN entries, and key size. Confirm that the Common Name matches the hostname clients will use and that every required name appears under the Subject Alternative Name list.

Generate a CSR on IIS 8 and 8.5 (Windows Server 2012 / 2012 R2)

The IIS 8 / 8.5 wizard is identical to IIS 10. Windows Server 2012 and 2012 R2 reached end of extended support in October 2023, so plan to move these workloads to a current Windows Server release; until you do, the steps below still work.

• Press Win + R, type inetmgr, and click OK. (Alternatively open Internet Information Services (IIS) Manager from the Start screen.)
• In Connections, select the server, then double-click Server Certificates in the Home pane.
• In Actions, click Create Certificate Request.
• In Distinguished Name Properties, fill in Common Name, Organization, Organizational unit, City/locality, State/province, and Country/region exactly as described under IIS 10 above (standard ASCII characters only, full state and city names, two-letter country code). Click Next.
• In Cryptographic Service Provider Properties, select Microsoft RSA SChannel Cryptographic Provider and set Bit length to 2048. Click Next.
• In File Name, pick a folder you can find again and save the file with a .txt extension (for example certreq.txt). Click Finish.
• Open the saved file in Notepad, copy the entire BEGIN NEW CERTIFICATE REQUEST to END NEW CERTIFICATE REQUEST block, and paste it into your order form.

The same SAN limitation applies on IIS 8 / 8.5: if you need more than one hostname, use the certreq.exe method above.

Generate a CSR on IIS 7 (Windows Server 2008 / 2008 R2)

Windows Server 2008 and 2008 R2 are long past end of support, so treat the IIS 7 wizard as a legacy procedure for systems you cannot yet replace. The flow is the same as IIS 8 / 10:

• Press Win + R, type inetmgr, and click OK, or open Start > Administrative Tools > Internet Information Services (IIS) Manager.
• In Connections, select the server name, then double-click Server Certificates.
• In Actions, click Create Certificate Request.
• In Distinguished Name Properties, enter Common Name, Organization, Organizational unit, City/locality, State/province, and Country/region as described under IIS 10. Click Next.
• In Cryptographic Service Provider Properties, choose Microsoft RSA SChannel Cryptographic Provider and 2048 bits. Click Next.
• Click the browse button under Specify a file name for the certificate request, pick a folder, type a file name ending in .txt, and click Finish.
• Open the saved file in Notepad, copy the full request block (including the BEGIN NEW CERTIFICATE REQUEST and END NEW CERTIFICATE REQUEST lines), and paste it into your order form.

Generate a CSR on IIS 5 and 6 (deprecated)

IIS 5 and 6 (Windows 2000 Server and Windows Server 2003) are long past end of support and should not run public sites. Use this section only if you are maintaining legacy infrastructure you cannot yet replace:

• Open Start > Control Panel > Administrative Tools > Internet Information Services.
• Right-click Default Web Site (or your site) and choose Properties.
• Open the Directory Security tab and click Server Certificate.
• In the IIS Certificate Wizard, select Create a new certificate and click Next.
• Select Prepare the request now, but send it later and click Next.
• Type a descriptive name for the certificate, set the Bit length to 2048, leave the other checkboxes unticked, and click Next.
• Enter the legal organization name and an Organizational unit (use a short label such as IT). Click Next.
• In Common Name, enter the FQDN of your site, for example www.example.com. Click Next.
• Fill in Country/region, State/province, and City/locality, then click Next.
• Pick a folder and a file name (save as .txt), click Next, review the summary, and click Next again to write the CSR.
• Open the file in Notepad, copy the entire request block, and paste it into your order form.

After the CA validates your CSR and issues the certificate, continue with the IIS SSL installation instructions.