Knowledge Base

EV SSL Certificate Installation in IIS 5 & 6

If you have not yet created a Certificate Signing Request (CSR) and ordered your certificate, see IIS SSL Certificate CSR Creation | Microsoft IIS.

Installing your EV SSL Certificate on your Windows 2000/2003 Server

As soon as your Extended Validation certificate is approved, it will be sent to the email address you entered during the order process. The EV Certificate files will all be included in a .zip attachment. The EV SSL Certificate can also be downloaded from your DigiCert Customer account inside the "EV Certificate Manager" area. You will only need the "Certificate Bundle" file. Save your Certificate Bundle from your DigiCert Customer Account to the desktop of the web server you are securing.

1. Go back into the site in IIS and complete the installation of your certificate:

   On your Windows Server, open your Administrative Tools, and go to Internet Information Services. On the Website that you created the CSR from earlier, right-click and select Properties. Select the Directory Security tab. Click the "Server Certificate..." button. The IIS Certificate Wizard will begin in a new window. Hit "Next".

   

2. On the Website that you created the CSR from earlier, right-click and select Properties. Select the Directory Security tab. Click the "Server Certificate..." button. The IIS Certificate Wizard will begin in a new window. Hit "Next".

   

3. Select the first option to process the pending request and install the certificate.

   

4. You will then "Browse" for your EV Certificate file. Locate your certificate (your_domain_name.cer), then click Next. Follow the rest of the wizard steps until finished.

Remove the Trusted Root Certificate from your server.

Note: This step is necessary to make your EV certificate backward compatible for older browsers.

1. From the Start menu, select 'Run...'. Type 'mmc' and hit Enter.

   

2. Under the "File" menu, choose Add/Remove Snap-in.

   

3. Click the "Add" button, and a new window will pop up. Click on "Certificates", and click Add.

   

   

4. Make sure to choose Computer Account (NOT User Account), then click Next, and Finish.

   

   

   Click OK to close the add snap-in window.

   

5. Back in the main MMC window, expand the Trusted Root Certification Authorities folder and click on "Certificates". Scroll down until you find the the Certificates "Issued To" DigiCert. You will probably see 3 of them. If you see a certificate Issued To "DigiCert High Assurance EV Root CA" with an expiration date of "11/9/2031," then right-click the certificate and delete it (It is necessary to delete the "DigiCert High Assurance EV Root CA" so that your certificate chains properly on older browsers)

   Close the MMC console. If it asks you, don't save the changes you made to the MMC as it closes.

Troubleshooting Tip: Internet Explorer 7 also requires that the phishing filter be turned ON to turn the address bar green.

Restart your Server.

You will normally just need to restart IIS to have it start using the new certificate. If that doesn't work, shut down and restart the whole server. The installation of your EV SSL Certificate is now complete.