{"id":524,"date":"2026-08-03T03:12:41","date_gmt":"2026-08-03T03:12:41","guid":{"rendered":"https:\/\/windows-vps.org\/blog\/?p=524"},"modified":"2026-08-03T03:12:41","modified_gmt":"2026-08-03T03:12:41","slug":"https-iis-windows-vps-ssl-http2-hsts","status":"publish","type":"post","link":"https:\/\/windows-vps.org\/blog\/https-iis-windows-vps-ssl-http2-hsts\/","title":{"rendered":"HTTPS on IIS for Windows VPS: SSL Certificates, HTTP\/2, and HSTS"},"content":{"rendered":"<p class=\"wp-block-paragraph\">A website served over plain HTTP on a Windows VPS leaks every password, token, and session cookie in transit \u2014 and modern browsers increasingly refuse to treat insecure pages as trustworthy. IIS ships with everything needed to run HTTPS-only, but the pieces \u2014 certificate provisioning, bindings, redirects, HTTP\/2, HSTS, TLS versions \u2014 have to be configured in the right order.<\/p>\n\n<p class=\"wp-block-paragraph\">The steps below assume IIS 10 on Windows Server 2019 or 2022. If you are still choosing where to host, <a href=\"https:\/\/windows-vps.org\/#providers\">compare Windows VPS plans on our comparison table<\/a>; the process is identical on any provider, but you want one that lets you open port 443 cleanly at the firewall level.<\/p>\n\n<h2 class=\"wp-block-heading\">Get a Certificate with Win-ACME<\/h2>\n\n<p class=\"wp-block-paragraph\">The easiest path to a trusted certificate is Let&#8217;s Encrypt via <strong>Win-ACME<\/strong>, a free Windows-native ACME client. Download it, then run from an elevated prompt, accepting the terms and using webroot validation against your site folder:<\/p>\n\n<pre class=\"wp-block-code\"><code>wacs.exe --run --accepttos --installation memory --webroot C:\\inetpub\\wwwroot\\contoso<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">Win-ACME creates the certificate, stores it in the computer certificate store, and schedules automatic renewal. For wildcard or SAN certificates, point DNS at the server first and use DNS validation instead of webroot.<\/p>\n\n<h2 class=\"wp-block-heading\">Bind the Certificate in IIS<\/h2>\n\n<p class=\"wp-block-paragraph\">In IIS Manager: select your site \u2192 <strong>Bindings<\/strong> \u2192 <strong>Add<\/strong> \u2192 type <code>https<\/code>, port <code>443<\/code>, pick the certificate, and tick <strong>Require Server Name Indication (SNI)<\/strong> if you host multiple HTTPS sites on one VPS. The same via PowerShell:<\/p>\n\n<pre class=\"wp-block-code\"><code>Import-Module IISAdministration\nNew-IISBinding -Name \"contoso\" -Protocol https -Port 443 -CertificateThumbprint \"THUMBPRINT\" -HostHeader contoso.example.com<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">Verify the binding took effect with <code>Get-IISSiteBinding -Name \"contoso\"<\/code>. If the certificate does not appear in the dropdown, it was imported into the wrong store \u2014 IIS reads certificates from the computer&#8217;s <strong>Personal<\/strong> store, so import the PFX there (not under your user account) or re-run Win-ACME with the <code>--certificatestore My<\/code> option.<\/p>\n\n<h2 class=\"wp-block-heading\">Redirect HTTP to HTTPS<\/h2>\n\n<p class=\"wp-block-paragraph\">Install the <strong>URL Rewrite<\/strong> module, then add a rule in <code>web.config<\/code> that permanently redirects every HTTP request:<\/p>\n\n<pre class=\"wp-block-code\"><code>&lt;rewrite&gt;\n  &lt;rules&gt;\n    &lt;rule name=\"Force HTTPS\" stopProcessing=\"true\"&gt;\n      &lt;match url=\"(.*)\" \/&gt;\n      &lt;conditions&gt;\n        &lt;add input=\"{HTTPS}\" pattern=\"off\" \/&gt;\n      &lt;\/conditions&gt;\n      &lt;action type=\"Redirect\" url=\"https:\/\/{HTTP_HOST}\/{R:1}\" redirectType=\"Permanent\" \/&gt;\n    &lt;\/rule&gt;\n  &lt;\/rules&gt;\n&lt;\/rewrite&gt;<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">Place it inside <code>&lt;system.webServer&gt;<\/code>. Test with <code>curl -I http:\/\/contoso.example.com<\/code> and confirm a 301 to the HTTPS URL.<\/p>\n\n<h2 class=\"wp-block-heading\">Enable HTTP\/2<\/h2>\n\n<p class=\"wp-block-paragraph\">Windows Server 2019 and 2022 support HTTP\/2 for TLS connections out of the box. If it is not active, enable it at the HTTP service level:<\/p>\n\n<pre class=\"wp-block-code\"><code>New-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\HTTP\\Parameters' -Name EnableHttp2Tls -Value 1 -PropertyType DWord -Force\nRestart-Service HTTP -Force<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">Verify with a browser devtools network panel or <code>curl -I --http2 https:\/\/contoso.example.com<\/code> \u2014 the response should report HTTP\/2.<\/p>\n\n<h2 class=\"wp-block-heading\">Enforce HSTS<\/h2>\n\n<p class=\"wp-block-paragraph\">HSTS tells browsers to only ever use HTTPS for your domain, eliminating downgrade attacks. Add the header in <code>web.config<\/code>:<\/p>\n\n<pre class=\"wp-block-code\"><code>&lt;httpProtocol&gt;\n  &lt;customHeaders&gt;\n    &lt;add name=\"Strict-Transport-Security\" value=\"max-age=31536000; includeSubDomains\" \/&gt;\n  &lt;\/customHeaders&gt;\n&lt;\/httpProtocol&gt;<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">Only enable <code>includeSubDomains<\/code> when every subdomain is HTTPS-ready, because the policy is sticky for a year.<\/p>\n\n<h2 class=\"wp-block-heading\">Disable TLS 1.0 and 1.1<\/h2>\n\n<p class=\"wp-block-paragraph\">Old TLS versions are deprecated and frequently flagged by security scanners. Disable them via the SChannel registry keys (create them if missing):<\/p>\n\n<pre class=\"wp-block-code\"><code>New-Item 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.0\\Server' -Force\nNew-ItemProperty 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.0\\Server' -Name Enabled -Value 0 -PropertyType DWord -Force\n# Repeat for \"TLS 1.1\\Server\", then reboot<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">After the reboot, confirm only TLS 1.2+ is offered:<\/p>\n\n<pre class=\"wp-block-code\"><code>openssl s_client -connect contoso.example.com:443 -tls1_2 -brief<\/code><\/pre>\n\n<h2 class=\"wp-block-heading\">Renewal and Monitoring<\/h2>\n\n<p class=\"wp-block-paragraph\">A certificate that expires silently is worse than no certificate at all \u2014 browsers hard-fail on expired TLS. Win-ACME&#8217;s scheduled task handles renewal, but you should still verify it works. Check the certificate expiry from outside with:<\/p>\n\n<pre class=\"wp-block-code\"><code>openssl s_client -connect contoso.example.com:443 -servername contoso.example.com 2&gt;\/dev\/null | openssl x509 -noout -dates<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">Add a monthly reminder to review the output, and set up a simple uptime or SSL check on your provider&#8217;s monitoring tool so you get alerted before the renewal window closes. If you manage several sites, keep renewal logs from Win-ACME in one place so a failed renewal is visible at a glance.<\/p>\n\n<h2 class=\"wp-block-heading\">Test Your HTTPS Setup<\/h2>\n\n<p class=\"wp-block-paragraph\">Before declaring victory, run a quick external check. First, confirm the redirect works:<\/p>\n\n<pre class=\"wp-block-code\"><code>curl -I http:\/\/contoso.example.com<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">You should see a <code>301<\/code> or <code>308<\/code> pointing at the HTTPS URL. Then verify the TLS configuration and HSTS header:<\/p>\n\n<pre class=\"wp-block-code\"><code>curl -sI https:\/\/contoso.example.com | grep -i strict-transport-security<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">Finally, run a free scan such as SSL Labs&#8217; SSL Server Test against your domain. It checks certificate chain, protocol support, and cipher strength, and it will immediately flag any leftover TLS 1.0 or 1.1 listeners you missed.<\/p>\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n<p class=\"wp-block-paragraph\">HTTPS on IIS is a sequence of small, well-documented steps: provision a certificate, bind it, redirect HTTP, enable HTTP\/2, set HSTS, and retire old TLS versions. Do them once and the site stays secure automatically. When you plan the deployment, <a href=\"https:\/\/windows-vps.org\/#providers\">see the full Windows VPS specs<\/a> and pick a plan with enough RAM for IIS plus the ASP.NET runtime. <a href=\"https:\/\/www.awin1.com\/cread.php?awinmid=116629&amp;awinaffid=2520403\" rel=\"noreferrer noopener sponsored\" target=\"_blank\">Database Mart&#8217;s Windows VPS hosting<\/a> includes pre-configured IIS options that cut the setup time considerably.<\/p>","protected":false},"excerpt":{"rendered":"<p>Serve IIS sites over HTTPS with free Let&#8217;s Encrypt certificates, redirect HTTP, enable HTTP\/2, enforce HSTS, and retire TLS 1.0\/1.1.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":0,"footnotes":""},"categories":[5],"tags":[],"class_list":["post-524","post","type-post","status-publish","format-standard","hentry","category-tutorials-guides"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>HTTPS on IIS for Windows VPS: SSL Certificates, HTTP\/2, and HSTS - Windows VPS Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/windows-vps.org\/blog\/https-iis-windows-vps-ssl-http2-hsts\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"HTTPS on IIS for Windows VPS: SSL Certificates, HTTP\/2, and HSTS\" \/>\n<meta property=\"og:description\" content=\"HTTPS on IIS for Windows VPS: SSL Certificates, HTTP\/2, and HSTS\" \/>\n<meta property=\"og:url\" content=\"https:\/\/windows-vps.org\/blog\/https-iis-windows-vps-ssl-http2-hsts\/\" \/>\n<meta property=\"og:site_name\" content=\"Windows VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-03T03:12:41+00:00\" \/>\n<meta name=\"author\" content=\"windows-vps\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"windows-vps\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/windows-vps.org\/blog\/https-iis-windows-vps-ssl-http2-hsts\/\",\"url\":\"https:\/\/windows-vps.org\/blog\/https-iis-windows-vps-ssl-http2-hsts\/\",\"name\":\"HTTPS on IIS for Windows VPS: SSL Certificates, HTTP\/2, and HSTS - Windows VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\"},\"datePublished\":\"2026-08-03T03:12:41+00:00\",\"author\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\"},\"breadcrumb\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/https-iis-windows-vps-ssl-http2-hsts\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/windows-vps.org\/blog\/https-iis-windows-vps-ssl-http2-hsts\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/windows-vps.org\/blog\/https-iis-windows-vps-ssl-http2-hsts\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/windows-vps.org\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"HTTPS on IIS for Windows VPS: SSL Certificates, HTTP\/2, and HSTS\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\",\"url\":\"https:\/\/windows-vps.org\/blog\/\",\"name\":\"Windows VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/windows-vps.org\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\",\"name\":\"windows-vps\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"caption\":\"windows-vps\"},\"sameAs\":[\"https:\/\/windows-vps.org\/blog\"],\"url\":\"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"HTTPS on IIS for Windows VPS: SSL Certificates, HTTP\/2, and HSTS - Windows VPS Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/windows-vps.org\/blog\/https-iis-windows-vps-ssl-http2-hsts\/","og_locale":"en_US","og_type":"article","og_title":"HTTPS on IIS for Windows VPS: SSL Certificates, HTTP\/2, and HSTS","og_description":"HTTPS on IIS for Windows VPS: SSL Certificates, HTTP\/2, and HSTS","og_url":"https:\/\/windows-vps.org\/blog\/https-iis-windows-vps-ssl-http2-hsts\/","og_site_name":"Windows VPS Blog","article_published_time":"2026-08-03T03:12:41+00:00","author":"windows-vps","twitter_card":"summary_large_image","twitter_misc":{"Written by":"windows-vps","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/windows-vps.org\/blog\/https-iis-windows-vps-ssl-http2-hsts\/","url":"https:\/\/windows-vps.org\/blog\/https-iis-windows-vps-ssl-http2-hsts\/","name":"HTTPS on IIS for Windows VPS: SSL Certificates, HTTP\/2, and HSTS - Windows VPS Blog","isPartOf":{"@id":"https:\/\/windows-vps.org\/blog\/#website"},"datePublished":"2026-08-03T03:12:41+00:00","author":{"@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58"},"breadcrumb":{"@id":"https:\/\/windows-vps.org\/blog\/https-iis-windows-vps-ssl-http2-hsts\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/windows-vps.org\/blog\/https-iis-windows-vps-ssl-http2-hsts\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/windows-vps.org\/blog\/https-iis-windows-vps-ssl-http2-hsts\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/windows-vps.org\/blog\/"},{"@type":"ListItem","position":2,"name":"HTTPS on IIS for Windows VPS: SSL Certificates, HTTP\/2, and HSTS"}]},{"@type":"WebSite","@id":"https:\/\/windows-vps.org\/blog\/#website","url":"https:\/\/windows-vps.org\/blog\/","name":"Windows VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/windows-vps.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58","name":"windows-vps","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","caption":"windows-vps"},"sameAs":["https:\/\/windows-vps.org\/blog"],"url":"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/"}]}},"_links":{"self":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/524","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/comments?post=524"}],"version-history":[{"count":1,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/524\/revisions"}],"predecessor-version":[{"id":527,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/524\/revisions\/527"}],"wp:attachment":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/media?parent=524"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/categories?post=524"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/tags?post=524"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}