NSFAQ (Not So Frequently Asked Questions)

It seems the usual procedure for renewing HTTPS certificates for IIS is starting a renewal request, sending it to de CA (Verisign, for example), wait for a file in the reply and import it inside your IIS.

But, what can we do if we have the renewal certificate with a former CSR? You get an e-mail with a part like this:

How can we import this inside our IIS? We should follow this steps:

First we export the current certifical. In order to do this, we should go to site properties, tab "Directory Security":

We start the wizard clicking on "Server Certificate" and go to next screen:

We click on "Next" and go to the next screen:

Where we will choose "Export the current certificate to a .pfx file". After that, we will be asked where to put it:

And a password for the export. This way we have our certificate exported.

If we look inside the file, we will see it is binary. To convert it to the same format we received on the email, we can use openssl, with this command:

It will ask us for the password we've put before, and will ask for another password to put to the .pem resulting file.
If we edit this file with any text editor, we will see it contains a "certificate" part, delimited by "BEGIN CERTIFICATE" and "END CERTIFICATE" clauses, exactly the same as the part we got on the email. We just should change the former certificate text with the new one. Once we have done this, we can put it again to binary, "understandable" by IIS. In order to do this, we use again openssl:

It will ask us for the .pem password, and another password to put to the resulting .pfx. Now, to put it in the IIS site, first we shoult take out the former certificate. In "Directory Security" tab we should start the wizard again, but this time we will choose "Remove the current certificate":

Clicking "next next" we will take out former certificate:

Now we should import the new certificate. In the wizard we will see a new option: "Import certificate from a .pfx file":

It will ask us for the file to import, and we should choose cert-new.pfx. It will ask us for the password, the port to listen (usually we will use the default 443) and finally we will have the certificate imported:

If we look at certificate properties, we will see expiration date has changed. We have the certificate renewed!