Configuring Web Deploy on IIS 10 and issues with the certificate

Question

We purchased a dedicated server with public IP addresses. I have a TLS certificate for a domain example.com. This domain has a dedicated IP. Publishing a website using:

https://example.com:8172/msdeploy.axd

Results in this message:

Management Service configuration:

I cannot change the certificate to match the domain mydomain.com, it only presents one certificate, WMSVC-SHA2. The IP on the domain matches the IP on Management Services. I can also go to the website and it shows the certificate is working.

How do I get Management Services to use the mydomain.com or even the certificate that we purchased so that it uses the right certificate?

Answer 1

You can use PowerShell to configure IIS web management service to use custom certificate. You can refer to my blog post on this subject: Configure IIS Web Administration to use centralized SSL certificate.

Here is a PowerShell function:

function Configure-WebAdministrationCertificate {
[CmdletBinding()]
    param(
        [Parameter(Mandatory = $true)]
        [Security.Cryptography.X509Certificates.X509Certificate2]$Certificate
    )
    if (!(Test-Path "HKLM:\SOFTWARE\Microsoft\WebManagement\Server")) {
        [void](New-Item -Path "HKLM:\SOFTWARE\Microsoft\WebManagement\" -Name "Server" -Force -ErrorAction Stop)
    }
    $Tokens = $Certificate.Thumbprint -split "([a-fA-F0-9]{2})" | ? {$_}
    [Byte[]]$Bytes = $Tokens | %{[Convert]::ToByte($_,16)}
    Set-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\WebManagement\Server -Name SslCertificateHash -Value $Bytes
    Import-Module WebAdministration
    del IIS:\SslBindings\0.0.0.0!8172
    $Certificate | New-Item -Path IIS:\SslBindings\0.0.0.0!8172 -Force
    Restart-Service -Name wmsvc
}

and use it:

$cert = gi cert:\LocalMachine\My\$Thumbprint
Configure-WebAdministrationCertificate $cert

where $Thumbprint variable stores a thumbprint value of the certificate.

Answer 2

You have to stop the service before you can edit the certificate.