How to Generate a CSR Code on Windows IIS Server (IIS 8, 10)

Before your SSL certificate can be issued by a Certificate Authority (CA), you must generate a Certificate Signing Request (CSR) on the server hosting your website. On Windows Server running Internet Information Services (IIS 8, 8.5, or 10), you can create a CSR directly through the IIS Manager console.

This guide provides step-by-step instructions for generating a CSR on Windows IIS and submitting it to the BuySSL.lk Client Area.

Step 1: Open IIS Manager

1. Press the Windows Key + R to open the Run dialog.

2. Type inetmgr and press Enter (or open Server Manager > Tools > Internet Information Services (IIS) Manager).

3. In the left Connections panel, click on your main Server Name.

Step 2: Open Server Certificates

1. In the central features view, scroll down to the IIS section.

2. Double-click on the Server Certificates icon.

Step 3: Initiate Certificate Request Creation

1. In the right-hand Actions panel, click on Create Certificate Request....

2. The Distinguished Name Properties wizard will open.

Step 4: Fill Out Distinguished Name Properties

Enter the required details carefully:

• Common Name: The exact fully qualified domain name (FQDN) you want to secure.

  • For Single Domain: Enter www.yourdomain.lk or yourdomain.lk.

  • For Wildcard SSL: Enter an asterisk before the domain, such as *.yourdomain.lk.

• Organization: Your officially registered business name (e.g., Example Lanka Pvt Ltd). For personal websites, enter your full name.

• Organizational Unit: Your department or division (e.g., IT Department or Web Division).

• City/locality: The full name of your city (e.g., Colombo). Do not abbreviate.

• State/province: The full name of your province or state (e.g., Western Province). Do not abbreviate.

• Country/region: Select your two-letter country code from the dropdown list (e.g., LK).

Click Next to proceed.

Step 5: Set Cryptographic Service Provider Properties

1. Cryptographic service provider: Select Microsoft RSA SChannel Cryptographic Provider.

2. Bit length: Select 2048 from the dropdown menu. This is a commonly supported key size for RSA-based SSL certificates.

3. Click Next.

Step 6: Specify File Name and Save the CSR

1. Click the ... (Browse) button to choose a destination folder and file name for your CSR (e.g., C:\csr.txt or on your Desktop).

2. Click Finish. IIS will generate the CSR file and save it to the specified path.

Step 7: Copy and Submit the CSR in BuySSL Client Area

1. Open the saved text file (csr.txt) using Notepad or any text editor.

2. Copy the entire content of the file, including the header -----BEGIN NEW CERTIFICATE REQUEST----- and footer -----END NEW CERTIFICATE REQUEST-----.

3. Log in to your BuySSL Client Area.

4. Go to Services > My Services > select your active SSL order.

5. Click Configure Certificate, choose Microsoft IIS as your web server type, paste the CSR into the box, and submit.

Pro-Tips & Important Notes:

• Do Not Delete the Pending Request: IIS automatically creates and stores the Private Key on the server when generating the CSR. Keep the pending certificate request until the SSL certificate is issued and installed. Do not remove or modify the pending certificate request in IIS while waiting for certificate issuance. Deleting the pending request may remove the connection between the CSR and its Private Key, which can prevent the issued certificate from being installed successfully..

• Completing the Certificate Request: Once BuySSL issues your certificate (.cer or .p7b file), you must return to IIS Manager > Server Certificates and click Complete Certificate Request... to finalize installation on Windows Server.