SSL Toolkit Logo
Tools Features Compare FAQ Login
IS

PEM/PFX to IIS Config

Convert your SSL certificate to a production-ready IIS web.config configuration.

About

This tool converts your SSL certificate (PEM format or PFX/PKCS12) into a production-ready IIS web.config configuration. It follows the Mozilla Server Side TLS guidelines — the same standards used by SSL Labs to grade servers.

IIS natively uses PFX/PKCS12 format for certificates. The generated config includes web.config bindings, SSL/TLS protocol settings, cipher suites, HSTS headers, and HTTP to HTTPS redirect rules. Simply paste your certificate or upload a PFX file, select a security profile, and get a copy-paste ready IIS config.

How to Use

  1. 1Upload your PEM certificate file or paste the data. You can also upload a PFX/PKCS12 file.
  2. 2If using PFX, enter the password in the PFX Password field.
  3. 3Select a security profile: Modern (TLS 1.3), Intermediate (TLS 1.2 + 1.3), or Old (legacy).
  4. 4Toggle features: HSTS, OCSP Stapling, HTTP to HTTPS redirect, HTTP/2.
  5. 5Click Generate IIS Config and copy or download the web.config configuration.

Use Cases

✓New IIS server — Generate SSL config when deploying a new IIS server.
✓Certificate renewal — Update IIS config after renewing your SSL certificate.
✓SSL Labs A+ — Generate configs that earn an A+ grade on SSL Labs.
✓HSTS preload — Get IIS config with HSTS headers ready for preload submission.
✓Cross-platform migration — Convert certificates from Nginx/Apache to IIS format.
✓Security hardening — Apply Mozilla recommended cipher suites to IIS.

Tips & Best Practices

  • •Use the Intermediate profile for most sites. Only use Modern if all clients support TLS 1.3.
  • •IIS natively uses PFX/PKCS12 format. Upload a PFX directly for best results.
  • •Install the PFX via IIS Manager or use certlm.msc to import to the Local Computer certificate store.
  • •Apply web.config via IIS Manager or copy the file to the site root directory.
  • •Restart IIS after config changes: iisreset /restart
  • •Enable HTTP Strict Transport Security in web.config for HSTS preload eligibility.

IIS SSL Directives Explained

bindingInformation / certificateHash

Binds the certificate to a specific IP and port. certificateHash is the thumbprint of the installed certificate.

sslFlags

Controls SSL behavior. 0 = standard SSL, 1 = SNI required, 2 = certificate store lookup, 4 = centralized SSL.

Negotiate / sslProtocols

Specifies allowed TLS versions. Modern: tls13. Intermediate: tls12 tls13. Controlled via Windows Registry on IIS 10+.

transport / strict-transport-security

HTTP response headers. transport enforces HTTPS redirect. strict-transport-security adds HSTS header.

Frequently Asked Questions

What files do I need for IIS SSL?

IIS requires a PFX/PKCS12 certificate installed in the Local Computer certificate store. Use this tool to convert PEM files to PFX, or upload an existing PFX. The tool generates the web.config bindings.

How do I install an SSL certificate on IIS?

Import the PFX via IIS Manager > Server Certificates > Import, or use certlm.msc. Then bind the certificate to your site via Site Bindings > Edit > SSL Certificate.

How do I reload IIS after changing SSL config?

Run iisreset /restart to restart IIS. For site-specific changes, you can simply re-apply the web.config or recycle the application pool.

Related Tools

All Servers

Configs for all 6 servers
Ng

PEM to Nginx

Nginx server block config
Ap

PEM to Apache

Apache VirtualHost config

SSL Checker

Verify your IIS config

SSL Converter

Convert cert formats

Cipher Ranking

Rank cipher suites