Windows IIS Deployment

CertOne imports certificates into the Windows local machine certificate store, updates an existing HTTPS binding on a specified website, and verifies its certificate thumbprint. It preserves the binding's SNI settings and does not require restarting all of IIS.

Prerequisites

• A deployment node with associated certificates, its node ID, and its Token.
• Windows with IIS and the WebAdministration management module installed.
• An existing HTTPS binding, with its site name, IP address, port, and hostname recorded.
• An account with permissions to manage IIS and the local machine certificate store.

If the website does not yet have an HTTPS binding, obtain an initial certificate using PFX Output, create the binding in IIS Manager, and then configure automatic updates.

The agent fetches all certificates associated with the node and selects the unique certificate matching the website's HTTPS hostname. Configure a separate target for each website; you do not need to enter certificate IDs individually. An empty hostname requires exactly one associated certificate. If multiple certificates match the same hostname, the agent reports an error; adjust the node associations or use an explicit advanced mapping.

1. Install the agent

Follow the Windows installation steps, then run certone version. Writing to the protected Program Files directory requires administrator privileges.

2. Inspect the binding and initialize

Inspect the existing bindings in an administrator PowerShell session. Administrator privileges are needed to access IIS management information and later update the binding:

Import-Module WebAdministration
Get-WebBinding -Protocol https | Select-Object ItemXPath, bindingInformation, sslFlags

Start the wizard, select iis, and enter values matching the existing binding:

certone init

The default configuration path is %USERPROFILE%\.certone\config.yaml for the current account. Record its actual path: the service must read the same configuration. Initialization itself does not require administrator privileges.

3. Verify and deploy

Run these commands in an administrator PowerShell session that can read the configuration. Administrator privileges are needed to import the certificate and update the IIS binding:

certone check --config "$env:USERPROFILE\.certone\config.yaml"
certone doctor --network --config "$env:USERPROFILE\.certone\config.yaml"
certone sync --once --config "$env:USERPROFILE\.certone\config.yaml"
certone status --config "$env:USERPROFILE\.certone\config.yaml"

If another account created the configuration, use its absolute path instead. After the checks pass, confirm the binding in IIS Manager and visit the actual HTTPS domain to verify the certificate and its expiration date.

4. Enable the background service

After verifying the first deployment, run the following in an administrator PowerShell session. Administrator privileges are needed to register and control the Windows service:

certone service install --config "$env:USERPROFILE\.certone\config.yaml"
certone service start --config "$env:USERPROFILE\.certone\config.yaml"
Get-Service certone

The program records the configuration file's absolute path. Restart the service after changing configuration, and use Background Services to inspect status and logs.

Configuration reference

Manual configuration in the system-wide ProgramData directory

For administrator-managed configuration, you can use C:\ProgramData\CertOne\config.yaml. First create and protect the directory using the Windows directory permissions instructions, then save the configuration below. This is an explicit custom location; the program's default remains the user directory.

node:
  id: node-REPLACE
  token: REPLACE_WITH_NODE_TOKEN
state_dir: 'C:\ProgramData\CertOne\state'
sync_interval: 1h
logging:
  level: info
  format: json
  file: 'C:\ProgramData\CertOne\logs\certone.log'
targets:
  - name: iis-site
    type: iis
    iis:
      site: Default Web Site
      ip: '*'
      port: 443
      host: example.com
      store: My

Field	Description
site	Exact IIS site name
ip	Binding IP; defaults to * when omitted and must match the existing binding
port	Required HTTPS port
host	Binding hostname; use an empty string '' if the existing binding has no hostname
store	My or WebHosting; defaults to My

Put the node Token in node.token. This file contains credentials; protect it as described in the Windows installation instructions. Do not add PFX output paths or file-target check/reload/verify settings to an IIS target.

All validation, deployment, and service commands for this example must explicitly use --config 'C:\ProgramData\CertOne\config.yaml'.

IIS notes

• The runtime account needs permission to manage IIS, import machine certificates, and write to the state directory.
• Central Certificate Store (CCS) bindings are not supported and produce an explicit error.
• The configuration must match one binding exactly. CertOne does not guess which site to update.
• Do not change a target's site, IP address, port, or hostname while an interrupted IIS update has an unresolved recovery record.
• An IIS target's verified status means its binding thumbprint was verified. It does not verify an external CDN or load balancer.
• Perform a manual verification on your Windows/IIS system before relying on automatic updates. Confirm that the actual service account has the required permissions, not just the interactive administrator account.