blocks|key|1402497|text|答案是使用NETSH。例如|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1402498|netsh+http+add+sslcert+ipport=0.0.0.0:443+certhash='baf9926b466e8565217b5e6287c97973dcd54874'+appid='{ab3c58f7-8316-42e3-bc6e-771d4ce4b201}'|code-block|syntax|javascript|1402499|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

The answer is to use NETSH.
For example

<pre><code>netsh http add sslcert ipport=0.0.0.0:443 certhash='baf9926b466e8565217b5e6287c97973dcd54874' appid='{ab3c58f7-8316-42e3-bc6e-771d4ce4b201}'
</code></pre>

blocks|key|1402633|text|这对我帮助很大:+Sukesh+Ashok+Kumar写的一本简单的指南，教我如何从命令行为IIS设置SSL。包括使用certutil+/+makecert导入/生成证书。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1402634|http://www.awesomeideas.net/post/How-to-configure-SSL-on-IIS7-under-Windows-2008-Server-Core.aspx|1402635|编辑:如果原始URL已关闭，它仍然可以使用through+the+Wayback+Machine。|1402636|entityMap|0|LINK|mutability|MUTABLE|url|1|https://web.archive.org/web/20131128023715/http://www.awesomeideas.net/post/How-to-configure-SSL-on-IIS7-under-Windows-2008-Server-Core.aspx^0|1N|8|1Y|8|0|0|2P|0|0|L|R|1|0^^$0|@$1|2|3|4|5|6|7|S|8|@$9|T|A|U|B|C]|$9|V|A|W|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|X|8|@]|D|@$9|Y|A|Z|1|10]]|E|$]]|$1|H|3|I|5|6|7|11|8|@]|D|@$9|12|A|13|1|14]]|E|$]]|$1|J|3|-4|5|6|7|15|8|@]|D|@]|E|$]]]|K|$L|$5|M|N|O|E|$P|G]]|Q|$5|M|N|O|E|$P|R]]]]

This helped me a lot: a simple guide, by Sukesh Ashok Kumar, to setting up SSL for IIS from the command line. Includes importing/generating the certificate with <code>certutil</code> / <code>makecert</code>.

<a href="http://www.awesomeideas.net/post/How-to-configure-SSL-on-IIS7-under-Windows-2008-Server-Core.aspx" rel="noreferrer">http://www.awesomeideas.net/post/How-to-configure-SSL-on-IIS7-under-Windows-2008-Server-Core.aspx</a>

EDIT: if the original URL is down, it's still available <a href="https://web.archive.org/web/20131128023715/http://www.awesomeideas.net/post/How-to-configure-SSL-on-IIS7-under-Windows-2008-Server-Core.aspx" rel="noreferrer">through the Wayback Machine</a>.

blocks|key|1617362|text|使用PowerShell和WebAdministration模块，您可以执行以下操作将SSL证书分配给IIS站点：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1617363|#+ensure+you+have+the+IIS+module+imported
Import-Module+WebAdministration

cd+IIS:\SslBindings
Get-Item+cert:\LocalMachine\My\7ABF581E134280162AFFFC81E62011787B3B19B5+%7C+New-Item+0.0.0.0!443|code-block|syntax|javascript|1617364|需要注意的事情...值"7ABF581E134280162AFFFC81E62011787B3B19B5“是要导入的证书的指纹。因此，需要先将其导入到证书库中。New-Item+cmdlet接受IP地址(所有IP均为0.0.0.0)和端口。|offset|length|style|CODE|1617365|有关更多详细信息，请参阅http://learn.iis.net/page.aspx/491/powershell-snap-in-configuring-ssl-with-the-iis-powershell-snap-in/。|1617366|我已经在Windows+Server2008+R2和Windows+Server2012预发行版中对其进行了测试。|1617367|entityMap|0|LINK|mutability|MUTABLE|url|http://learn.iis.net/page.aspx/491/powershell-snap-in-configuring-ssl-with-the-iis-powershell-snap-in/^0|0|0|28|8|0|C|2U|0|0|0^^$0|@$1|2|3|4|5|6|7|Y|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|Z|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|10|8|@$I|11|J|12|K|L]]|9|@]|A|$]]|$1|M|3|N|5|6|7|13|8|@]|9|@$I|14|J|15|1|16]]|A|$]]|$1|O|3|P|5|6|7|17|8|@]|9|@]|A|$]]|$1|Q|3|-4|5|6|7|18|8|@]|9|@]|A|$]]]|R|$S|$5|T|U|V|A|$W|X]]]]

With PowerShell and the WebAdministration module, you can do the following to assign an SSL certificate to an IIS site:

<pre><code># ensure you have the IIS module imported
Import-Module WebAdministration

cd IIS:\SslBindings
Get-Item cert:\LocalMachine\My\7ABF581E134280162AFFFC81E62011787B3B19B5 | New-Item 0.0.0.0!443
</code></pre>

Things to note... the value, "7ABF581E134280162AFFFC81E62011787B3B19B5" is the thumbprint for the certificate you want to import. So it needs to be imported into the certificate store first. The <code>New-Item</code> cmdlet takes in the IP address (0.0.0.0 for all IPs) and the port.

See <a href="http://learn.iis.net/page.aspx/491/powershell-snap-in-configuring-ssl-with-the-iis-powershell-snap-in/">http://learn.iis.net/page.aspx/491/powershell-snap-in-configuring-ssl-with-the-iis-powershell-snap-in/</a> for more details.

I've tested this in Windows Server 2008 R2 as well as Windows Server 2012 pre-release.

blocks|key|1402718|text|使用这篇文章中的答案，我创建了一个脚本，为我做了这件事。它从pfx文件开始，但您可以跳过这一步。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1402719|这就是它：|1402720|cd+C:\Windows\System32\inetsrv

certutil+-f+-p+"pa$$word"+-importpfx+"C:\temp\mycert.pfx"

REM+The+thumbprint+is+gained+by+installing+the+certificate,+going+to+cert+manager+>+personal,+clicking+on+it,+then+getting+the+Thumbprint.
REM+Be+careful+copying+the+thumbprint.+It+can+add+hidden+characters,+esp+at+the+front.
REM+appid+can+be+any+valid+guid
netsh+http+add+sslcert+ipport=0.0.0.0:443+certhash=5de934dc39cme0234098234098dd111111111115+appid={75B2A5EC-5FD8-4B89-A29F-E5D038D5E289}

REM+bind+to+all+ip's+with+no+domain.+There+are+plenty+of+examples+with+domain+binding+on+the+web
appcmd+set+site+"Default+Web+Site"+/%2Bbindings.[protocol='https',bindingInformation='*:443:']|code-block|syntax|javascript|1402721|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|L|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|M|8|@]|9|@]|A|$G|H]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

Using the answers from this post, I created a single script that did the trick for me. It starts from the pfx file, but you could skip that step.

Here it is:

<pre><code>cd C:\Windows\System32\inetsrv

certutil -f -p "pa$$word" -importpfx "C:\temp\mycert.pfx"

REM The thumbprint is gained by installing the certificate, going to cert manager &gt; personal, clicking on it, then getting the Thumbprint.
REM Be careful copying the thumbprint. It can add hidden characters, esp at the front.
REM appid can be any valid guid
netsh http add sslcert ipport=0.0.0.0:443 certhash=5de934dc39cme0234098234098dd111111111115 appid={75B2A5EC-5FD8-4B89-A29F-E5D038D5E289}

REM bind to all ip's with no domain. There are plenty of examples with domain binding on the web
appcmd set site "Default Web Site" /+bindings.[protocol='https',bindingInformation='*:443:']
</code></pre>

blocks|key|1617475|text|如果您试图在不使用MMC+snap-in+GUI的情况下执行IIS+Administration，则应该使用powershell+WebAdministration模块。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1617476|此博客上的其他答案不适用于更高版本的Windows+Server+(2012)|1617477|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

If you're trying to perform IIS Administration without using the MMC snap-in GUI, you should use the powershell WebAdministration module. 

The other answers on this blog don't work on later versions of Windows Server (2012)

blocks|key|1617520|text|使用PowerShell+%2B+netsh|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1617521|$certificateName+=+'example.com'
$thumbprint+=+Get-ChildItem+-path+cert:\LocalMachine\My+%7C+where+{+$_.Subject.StartsWith("CN=$certificateName")+}+%7C+Select-Object+-Expand+Thumbprint
$guid+=+[guid]::NewGuid().ToString("B")
netsh+http+add+sslcert+ipport="0.0.0.0:443"+certhash=$thumbprint+certstorename=MY+appid="$guid"|code-block|syntax|javascript|1617522|如果您需要命名绑定，请将netsh调用替换为：|1617523|netsh+http+add+sslcert+hostnameport="$certificateName:443"+certhash=$thumbprint+certstorename=MY+appid="$guid"|1617524|entityMap^0|2|A|F|5|0|0|C|5|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@$9|R|A|S|B|C]|$9|T|A|U|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|V|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|W|8|@$9|X|A|Y|B|C]]|D|@]|E|$]]|$1|M|3|N|5|H|7|Z|8|@]|D|@]|E|$I|J]]|$1|O|3|-4|5|6|7|10|8|@]|D|@]|E|$]]]|P|$]]

Using <code>PowerShell</code> + <code>netsh</code>:

<pre><code>$certificateName = 'example.com'
$thumbprint = Get-ChildItem -path cert:\LocalMachine\My | where { $_.Subject.StartsWith("CN=$certificateName") } | Select-Object -Expand Thumbprint
$guid = [guid]::NewGuid().ToString("B")
netsh http add sslcert ipport="0.0.0.0:443" certhash=$thumbprint certstorename=MY appid="$guid"
</code></pre>

If you need a named binding, replace <code>netsh</code> call with this:

<pre><code>netsh http add sslcert hostnameport="$certificateName:443" certhash=$thumbprint certstorename=MY appid="$guid"
</code></pre>

blocks|key|1402848|text|使用IISAdministration+1.1.0.0+(https://www.powershellgallery.com/packages/IISAdministration/1.1.0.0)，您可以使用以下代码将新的HTTPS绑定添加到特定站点：|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1402849|$thumbPrint+=+(gci+Cert:\localmachine\My+%7C+Where-Object+{+$_.Subject+-Like+"certSubject*"+}).Thumbprint
New-IISSiteBinding+-Name+"Site+Name"+-BindingInformation+"*:443:"+-CertificateThumbPrint+$thumbPrint+-CertStoreLocation+My+-Protocol+https|code-block|syntax|javascript|1402850|查看现有绑定|1402851|Get-IISSiteBinding+-Name+"Site+Name"|1402852|使用删除现有绑定|1402853|Remove-IISSiteBinding+-Name+"Site+Name"+-BindingInformation+"*:443:"+-Protocol+https+-Confirm:$False|1402854|entityMap|0|LINK|mutability|MUTABLE|url|https://www.powershellgallery.com/packages/IISAdministration/1.1.0.0^0|T|1W|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Y|8|@]|9|@$A|Z|B|10|1|11]]|C|$]]|$1|D|3|E|5|F|7|12|8|@]|9|@]|C|$G|H]]|$1|I|3|J|5|6|7|13|8|@]|9|@]|C|$]]|$1|K|3|L|5|F|7|14|8|@]|9|@]|C|$G|H]]|$1|M|3|N|5|6|7|15|8|@]|9|@]|C|$]]|$1|O|3|P|5|F|7|16|8|@]|9|@]|C|$G|H]]|$1|Q|3|-4|5|6|7|17|8|@]|9|@]|C|$]]]|R|$S|$5|T|U|V|C|$W|X]]]]

With IISAdministration 1.1.0.0 (<a href="https://www.powershellgallery.com/packages/IISAdministration/1.1.0.0" rel="nofollow noreferrer">https://www.powershellgallery.com/packages/IISAdministration/1.1.0.0</a>) you can use the following code to add a new HTTPS binding to a specific site:
<pre><code>$thumbPrint = (gci Cert:\localmachine\My | Where-Object { $_.Subject -Like &quot;certSubject*&quot; }).Thumbprint
New-IISSiteBinding -Name &quot;Site Name&quot; -BindingInformation &quot;*:443:&quot; -CertificateThumbPrint $thumbPrint -CertStoreLocation My -Protocol https
</code></pre>
View existing bindings with
<pre><code>Get-IISSiteBinding -Name &quot;Site Name&quot;
</code></pre>
Remove an existing binding with
<pre><code>Remove-IISSiteBinding -Name &quot;Site Name&quot; -BindingInformation &quot;*:443:&quot; -Protocol https -Confirm:$False
</code></pre>

Can you advise me whether it is possible or not to assign a SSL Certificate to a website in IIS7 using the APPCMD application?

I am familiar with the command to set the HTTPS Binding

<pre><code>appcmd set site /site.name:"A Site" /+bindings.[protocol='https',bindingInformation='*:443:www.mysite.com']
</code></pre>

and how to obtain current mappings 

<pre><code>%windir%\system32\inetsrv\Appcmd
</code></pre>

but can not seem to find any way to map a site to a certificate (say the certificates hash for example)

How to assign a SSL Certificate to IIS7 Site from Command Prompt

Windows Server

Windows

您能否告知我，是否可以使用APPCMD应用程序将SSL证书分配给IIS7中的网站？我熟悉设置HTTPS绑定的命令appcmd set site /site.name:"A Site" /+bindings.[protocol='https',bindingInformation='*:443:www.mysite.com']以及如何获取当前映射%windir%\system32\inetsrv\A

问如何从命令提示符将SSL证书分配给IIS7站点
EN

回答 7

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何从命令提示符将SSL证书分配给IIS7站点EN

回答 7

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何从命令提示符将SSL证书分配给IIS7站点
EN