HTTPS on IIS for Windows VPS: SSL Certificates, HTTP/2, and HSTS

A website served over plain HTTP on a Windows VPS leaks every password, token, and session cookie in transit — and modern browsers increasingly refuse to treat insecure pages as trustworthy. IIS ships with everything needed to run HTTPS-only, but the pieces — certificate provisioning, bindings, redirects, HTTP/2, HSTS, TLS versions — have to be configured in the right order.

The steps below assume IIS 10 on Windows Server 2019 or 2022. If you are still choosing where to host, compare Windows VPS plans on our comparison table; the process is identical on any provider, but you want one that lets you open port 443 cleanly at the firewall level.

Get a Certificate with Win-ACME

The easiest path to a trusted certificate is Let’s Encrypt via Win-ACME, a free Windows-native ACME client. Download it, then run from an elevated prompt, accepting the terms and using webroot validation against your site folder:

wacs.exe --run --accepttos --installation memory --webroot C:\inetpub\wwwroot\contoso

Win-ACME creates the certificate, stores it in the computer certificate store, and schedules automatic renewal. For wildcard or SAN certificates, point DNS at the server first and use DNS validation instead of webroot.

Bind the Certificate in IIS

In IIS Manager: select your site → Bindings → Add → type https, port 443, pick the certificate, and tick Require Server Name Indication (SNI) if you host multiple HTTPS sites on one VPS. The same via PowerShell:

Import-Module IISAdministration
New-IISBinding -Name "contoso" -Protocol https -Port 443 -CertificateThumbprint "THUMBPRINT" -HostHeader contoso.example.com

Verify the binding took effect with Get-IISSiteBinding -Name "contoso". If the certificate does not appear in the dropdown, it was imported into the wrong store — IIS reads certificates from the computer’s Personal store, so import the PFX there (not under your user account) or re-run Win-ACME with the --certificatestore My option.

Redirect HTTP to HTTPS

Install the URL Rewrite module, then add a rule in web.config that permanently redirects every HTTP request:

<rewrite>
  <rules>
    <rule name="Force HTTPS" stopProcessing="true">
      <match url="(.*)" />
      <conditions>
        <add input="{HTTPS}" pattern="off" />
      </conditions>
      <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
    </rule>
  </rules>
</rewrite>

Place it inside <system.webServer>. Test with curl -I http://contoso.example.com and confirm a 301 to the HTTPS URL.

Enable HTTP/2

Windows Server 2019 and 2022 support HTTP/2 for TLS connections out of the box. If it is not active, enable it at the HTTP service level:

New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\HTTP\Parameters' -Name EnableHttp2Tls -Value 1 -PropertyType DWord -Force
Restart-Service HTTP -Force

Verify with a browser devtools network panel or curl -I --http2 https://contoso.example.com — the response should report HTTP/2.

Enforce HSTS

HSTS tells browsers to only ever use HTTPS for your domain, eliminating downgrade attacks. Add the header in web.config:

<httpProtocol>
  <customHeaders>
    <add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains" />
  </customHeaders>
</httpProtocol>

Only enable includeSubDomains when every subdomain is HTTPS-ready, because the policy is sticky for a year.

Disable TLS 1.0 and 1.1

Old TLS versions are deprecated and frequently flagged by security scanners. Disable them via the SChannel registry keys (create them if missing):

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -Force
New-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -Name Enabled -Value 0 -PropertyType DWord -Force
# Repeat for "TLS 1.1\Server", then reboot

After the reboot, confirm only TLS 1.2+ is offered:

openssl s_client -connect contoso.example.com:443 -tls1_2 -brief

Renewal and Monitoring

A certificate that expires silently is worse than no certificate at all — browsers hard-fail on expired TLS. Win-ACME’s scheduled task handles renewal, but you should still verify it works. Check the certificate expiry from outside with:

openssl s_client -connect contoso.example.com:443 -servername contoso.example.com 2>/dev/null | openssl x509 -noout -dates

Add a monthly reminder to review the output, and set up a simple uptime or SSL check on your provider’s monitoring tool so you get alerted before the renewal window closes. If you manage several sites, keep renewal logs from Win-ACME in one place so a failed renewal is visible at a glance.

Test Your HTTPS Setup

Before declaring victory, run a quick external check. First, confirm the redirect works:

curl -I http://contoso.example.com

You should see a 301 or 308 pointing at the HTTPS URL. Then verify the TLS configuration and HSTS header:

curl -sI https://contoso.example.com | grep -i strict-transport-security

Finally, run a free scan such as SSL Labs’ SSL Server Test against your domain. It checks certificate chain, protocol support, and cipher strength, and it will immediately flag any leftover TLS 1.0 or 1.1 listeners you missed.

Conclusion

HTTPS on IIS is a sequence of small, well-documented steps: provision a certificate, bind it, redirect HTTP, enable HTTP/2, set HSTS, and retire old TLS versions. Do them once and the site stays secure automatically. When you plan the deployment, see the full Windows VPS specs and pick a plan with enough RAM for IIS plus the ASP.NET runtime. Database Mart’s Windows VPS hosting includes pre-configured IIS options that cut the setup time considerably.