Challenge 3: Why the Windows Certificate Store Is a Genuine Architectural Difference — Solution Walkthrough

What Apache and Nginx actually do:

Both point a config directive directly at certificate and private key
files sitting on the filesystem — SSLCertificateFile/
SSLCertificateKeyFile for Apache, ssl_certificate/ssl_certificate_key
for Nginx. The certificate's "location," as far as the web server is
concerned, is simply a file path, managed the same way any other file
on the server is managed (copied, permissioned, backed up).

What IIS actually does instead:

IIS doesn't reference a certificate file path at all. Certificates are
first imported into the Windows Certificate Store — a separate,
OS-level certificate management system with its own storage, access
controls, and tooling (independent of IIS itself) — and an HTTPS
binding in IIS Manager then references a specific certificate already
sitting in that store, identified by the store rather than by a file
path.

Why this is architectural, not just a syntax difference:

A syntax difference would mean both approaches ultimately point at
"a certificate file," just written differently in each config format.
That's not what's happening here — Apache and Nginx's model has no
concept of a system-wide certificate store at all, while IIS has no
concept of pointing directly at a file path the way the other two do.
Managing, renewing, and securing certificates works through genuinely
different systems and tooling depending on which of these two models a
given server uses, which is a structural difference in how each
platform is built, not a cosmetic one.

WHY THIS WORKS AS AN ANSWER
------------------------------
This exercise checks that "file-based" vs. "OS certificate store"
is understood as a genuine architectural distinction with real
practical consequences (different management tooling, different
security model) — the same category of "structural, not just
syntax" difference this course has drawn out in earlier chapters
(e.g. Chapter 3's own directory-context vs. centralized config
distinction).