Skip to main content
Integrate Microsoft Internet Information Services (IIS) with CryptoHub to protect the HTTPS server certificate’s private key in the HSM. When IIS serves a site over HTTPS, the Windows Schannel security package performs the TLS handshake and uses the site certificate’s private key to authenticate the server. In a default deployment, that key is stored in software on the web server. In this integration, the key is generated and held in CryptoHub, and reached from Windows through the Futurex FXCL CNG provider: the TLS key pair and its certificate are created on the CryptoHub through PKI Management, only the public certificate is imported on the IIS server and bound to the CryptoHub-resident key, and every TLS private key operation at handshake time is performed inside CryptoHub. The IIS server never holds the private key.
This guide covers TLS server certificates for IIS. If you are configuring the Microsoft Online Responder (OCSP), which uses IIS only as an HTTP transport and does not require a server certificate, see the Microsoft OCSP integration guide instead.
CryptoHub is the CA in this integration; you do not need a separate Microsoft CA. The key and certificate are both generated on the CryptoHub through PKI Management. This differs from a traditional IIS enrollment, where certreq creates the key and a Microsoft CA issues against it. On CryptoHub 7.0.3.x, client-driven certreq key generation through the FXCL CNG provider is rejected by the appliance, so this guide uses the CryptoHub-generated pattern throughout.

​
Key features

This integration has the following features:
  • HSM-protected TLS key through Futurex FXCL KMES CNG: The IIS server certificate’s private key is generated and held in CryptoHub, and reached from Windows through the Futurex FXCL KMES CNG provider, so TLS handshakes are completed without the private key ever leaving the HSM.
  • CryptoHub-issued certificate, no separate CA required: The TLS key pair and certificate are both created on the CryptoHub through PKI Management. Only the public certificate is installed on the IIS server; no third-party enrollment software is required.
  • Standard Windows binding tooling: The public certificate is imported and bound to its CryptoHub-resident key using built-in Windows tools (certutil), then bound to the site in IIS Manager.

​
Benefits of CryptoHub integration through CNG

Integrating with CryptoHub provides the following benefits:
  • HSM-protected server key: The TLS private key is generated as a non-exportable key inside CryptoHub, so it cannot be extracted from the web server, including by an attacker who compromises the host.
  • Private key operations inside the HSM: Every TLS handshake’s server key operation is performed in the HSM through the CNG provider.
  • Compliance advantage: Keeping the TLS key in a CryptoHub helps you meet stringent regulatory requirements for secure key management, such as FIPS 140-2 or other industry-specific standards.
  • Centralized key management: Using a CryptoHub centralizes the storage and management of cryptographic keys, making them easier to manage and more secure against potential threats.
  • Operational resilience: CryptoHub has high availability and failover capabilities, ensuring TLS service remains available and reliable.