Roadmap › IIS — Internet Information Services and Hosting .NET Applications › Module: Hosting .NET Applications
Lessons in this course (9)
6. HTTPS, certificates, authentication and security hardening
Intermediate★ Must knowLesson 6 of 9
HTTPS: import the certificate (PFX) into Local Machine\Personal (or use the Centralized Certificate Store), add an https binding with SNI, redirect HTTP → HTTPS (URL Rewrite rule or app-level UseHttpsRedirection), enable HSTS. Free certificates: win-acme automates Let's Encrypt issuance and renewal for IIS.
powershell
$cert = Import-PfxCertificate -FilePath C:\certs\shop.pfx -CertStoreLocation Cert:\LocalMachine\My -Password (Read-Host -AsSecureString)
New-WebBinding -Name Shop -Protocol https -Port 443 -HostHeader www.shop.com -SslFlags 1
(Get-WebBinding -Name Shop -Protocol https).AddSslCertificate($cert.Thumbprint, "My")Authentication options (IIS level):
| Mode | Use |
|---|---|
| Anonymous | Public sites (app handles login with cookies/JWT) |
| Windows Authentication (Negotiate/Kerberos, NTLM) | Intranet apps with Active Directory — [Authorize] and User.Identity.Name = DOMAIN\user |
| Basic | Avoid (only over HTTPS, legacy) |
| Client certificate mapping | Machine-to-machine |
Hardening checklist: remove unused modules/handlers and the default site, least-privilege pool identities, disable directory browsing, remove Server/X-Powered-By/X-AspNet-Version headers, request filtering (limits, blocked extensions like .config), disable TLS 1.0/1.1 and weak ciphers (IIS Crypto tool), keep Windows patched, custom error pages, log retention, separate app pools per site.