How to Transfer an SSL/TLS Certificate from cPanel/Apache to IIS

Option 1: Transfer the Existing Certificate Using a PFX File

A PFX file contains an SSL/TLS certificate, its corresponding private key, and optionally the intermediate certificate chain. IIS supports importing certificates in this format.

Step 1: Locate Your Certificate and Private Key

Find the following files on your cPanel-managed hosting account:

• Private Key: .key
• SSL/TLS Certificate: .crt or .pem
• CA Bundle: Intermediate certificates, if available.

In cPanel, open Security → SSL/TLS (or SSL/TLS Certificates) to access your private keys and certificates. The available options depend on your hosting provider's configuration.

You do not necessarily need root or SSH access if you can retrieve these files through cPanel.

Step 2: Create a PFX File

Use OpenSSL to export the certificate and private key:

openssl pkcs12 -export -out example.com.pfx -inkey example.com.key -in example.com.crt -certfile ca-bundle.crt

Replace the file names and paths with your actual files. If you do not have a separate CA bundle, omit the -certfile option.

OpenSSL will prompt you to set an export password. Keep it safe because you will need it when importing the PFX file into IIS.

Step 3: Import the PFX File into IIS

1. Open IIS Manager.
2. Select your server name.
3. Open Server Certificates.
4. Click Import.
5. Select the PFX file and enter its password.
6. Select the Personal certificate store.
7. Click OK.

Step 4: Configure the HTTPS Binding

1. Expand Sites and select your website.
2. Click Bindings → Add or edit the existing HTTPS binding.
3. Set the type to https and the port to 443.
4. Select the imported SSL/TLS certificate.
5. Click OK.

Visit your website over HTTPS to verify the installation.

Option 2: Reissue the Certificate for IIS

If you cannot access the original private key, you cannot create a PFX containing it. Instead, generate a new private key and CSR on the Windows server and request a certificate reissue.

1. Open IIS Manager and select your server.
2. Open Server Certificates.
3. Click Create Certificate Request.
4. Enter your organization and domain details, select the key size, and save the CSR.
5. Submit the CSR to GoGetSSL through the certificate reissue process.
6. Once the replacement certificate is issued, return to Server Certificates and select Complete Certificate Request.
7. Select the issued certificate file and complete the installation.

Finally, configure the HTTPS binding as described in Option 1.

Conclusion

You can transfer an existing SSL/TLS certificate from cPanel or Apache to IIS by exporting it as a PFX file, provided you have its matching private key.

If the private key is lost, request a certificate reissue using a new CSR generated on the Windows server.

In either case, verify the certificate and HTTPS binding before removing the files from the original server. Keep PFX files and private keys secure, as they allow access to your certificate's private key.