This guide shows the GUI method in IIS Manager and the PowerShell method. It also covers binding the certificate to a site and optional export.

GUI method in IIS Manager

1) Open IIS Manager (inetmgr).

2) In the Connections pane, click your server name.

3) Double-click Server Certificates.

4) In the Actions pane, click Create Self-Signed Certificate.

5) Enter a friendly name, for example MySelfSignedCert.

6) Choose the Personal store and click OK.

7) Bind to your site: expand Sites, select the site, click Bindings, add or edit an https binding, choose the certificate, then click OK.

PowerShell method

Run in an elevated PowerShell session.

Create the certificate

$hostname = "example.local"
$cert = New-SelfSignedCertificate `
    -DnsName $hostname `
    -CertStoreLocation "cert:\LocalMachine\My" `
    -FriendlyName "MySelfSignedCert" `
    -KeyLength 2048 `
    -HashAlgorithm sha256 `
    -KeyExportPolicy Exportable `
    -NotAfter (Get-Date).AddYears(1)

Create a certificate with multiple DNS names (optional)

$cert = New-SelfSignedCertificate `
    -DnsName "example.local","www.example.local","api.example.local" `
    -CertStoreLocation "cert:\LocalMachine\My" `
    -FriendlyName "MySelfSignedCert SAN" `
    -KeyLength 2048 `
    -HashAlgorithm sha256 `
    -KeyExportPolicy Exportable `
    -NotAfter (Get-Date).AddYears(1)

Bind the certificate to an IIS site with SNI

Import-Module WebAdministration

$siteName = "MyNewSite"
$hostname = "example.local"
$httpsPort = 443

# Ensure an https binding exists for the hostname
if (-not (Get-WebBinding -Name $siteName -Protocol "https" -ErrorAction SilentlyContinue | Where-Object { $_.bindingInformation -match ":$httpsPort:$hostname" })) {
    New-WebBinding -Name $siteName -Protocol "https" -Port $httpsPort -HostHeader $hostname | Out-Null
}

# Attach the certificate to the binding
$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.FriendlyName -eq "MySelfSignedCert" } | Select-Object -First 1
$bindingPath = "IIS:\SslBindings.0.0.0!$httpsPort!$hostname"

if (-not (Test-Path $bindingPath)) {
    New-Item $bindingPath -Thumbprint $cert.Thumbprint -SSLFlags 1 | Out-Null
} else {
    Set-Item -Path $bindingPath -Thumbprint $cert.Thumbprint -SSLFlags 1
}

Export the certificate to PFX for client trust (optional)

$pwd = ConvertTo-SecureString "P@ssw0rd!" -AsPlainText -Force
$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.FriendlyName -eq "MySelfSignedCert" } | Select-Object -First 1
Export-PfxCertificate -Cert $cert -FilePath "C:\Temp\MySelfSignedCert.pfx" -Password $pwd

Notes and recommendations

• Self-signed certificates are suitable for labs and internal testing. Browsers will warn because they are not from a trusted CA.

• For production, use a certificate from a trusted CA or use ACME automation such as Let’s Encrypt.

• To remove browser warnings on internal machines, distribute the certificate or the issuing root to Trusted Root Certification Authorities on client devices. In an Active Directory environment, use Group Policy to deploy trust.