IIS replace certificate: swap the SSL certificate on a live site

9 min readUpdated Oct 2026

Replacing a certificate on IIS means pointing every HTTPS binding that carries the old certificate at the new one. A binding keeps a certificate hash and the name of the certificate store ^[7], so the new certificate belongs in a store on the server before you point a binding at it. This page is for a site that already serves HTTPS. It lists the places where the old certificate can stay behind, gives the order of work, and ends with a check for each binding. The general procedure is in installing an SSL certificate on any server, and a first-time setup on this machine is on the IIS install page.

Binding key: An IIS HTTPS binding is addressed by IP address and port, by host name and port (server name indication), or by a Centralized Certificate Store port ^[1]
What a binding stores: The HTTP.sys SSL configuration of a site binding holds a certificate hash and the name of the certificate store ^[7]
One per address: Only one certificate can be bound to a combination of IP address and port ^[7]
Central store: A binding that uses Centralized SSL Certificate Support has no certificate hash ^[6]
Identity in PowerShell: A certificate object exposes its certificate thumbprint, serial number, NotAfter date and whether it holds a private key ^[4]

Find every binding that still uses the old certificate

Start with a list. netsh http show sslcert without an argument displays all available SSL server certificate bindings ^[1]. Write down each entry that carries the old certificate's thumbprint. In IIS Manager, expand Sites, click the site and choose Bindings in the Actions pane to see each site binding ^[7]; Get-IISSiteBinding shows them with their status ^[2]. To find the old certificate itself, list a store and read its thumbprint and NotAfter date ^[4]:

Get-ChildItem Cert:\LocalMachine\My | Format-List Subject, Thumbprint, NotAfter
Get-ChildItem Cert:\LocalMachine\WebHosting -ExpiringInDays 30

The second line returns the certificates in that store that expire within the next 30 days ^[3].

Where the old certificate can stay behind

Find every binding that still uses the old certificate
Binding or store	How to see it	How to repoint it
IP address and port	`netsh http show sslcert ipport=<ip>:<port>`; only one certificate is bound to that pair ^[1] ^[7]	`netsh http update sslcert ipport=<ip>:<port> certhash=<new thumbprint> certstorename=MY` ^[1]
SNI binding, listed by host name and port	`netsh http show sslcert hostnameport=<name>:<port>` ^[1] ^[5]	The same command with `hostnameport`; repeat it for each entry with the old thumbprint ^[1]
Centralized Certificate Store binding	`netsh http show sslcert ccs=<port>`; the binding has no certificate hash ^[1] ^[6]	Nothing in the binding to change. The certificate is inferred from the SNI value or host name: look at the file named after the host name on the share ^[6]
Personal or Web Hosting store	The binding holds the store name with the hash. The Web Hosting store, created to complement SNI, works like the Personal store ^[5] ^[7]	Name the store where the new certificate sits: `certstorename` for netsh, `-CertStoreLocation` for `New-IISSiteBinding` ^[1] ^[2]
IP and port bindings next to SNI bindings	IIS Manager may remove an unintended SSL binding when both kinds exist ^[5]	After any edit in IIS Manager, run `netsh http show sslcert` and compare it with your list ^[5]

Replace the certificate

Prepare the new certificate

To replace an SSL certificate on IIS, start with the new one.

Put the new certificate on the server. The IIS 7 documentation for Complete Certificate Request says the server certificate can be installed only on the computer from which the request was sent ^[8]. The request and the import are described on the IIS install page, and a certificate that arrives as a file is covered by import and export a certificate.
Confirm the key came with it. HasPrivateKey reports whether the certificate object contains a private key ^[4]. Read it, with the thumbprint, before you bind anything:
```
Get-ChildItem Cert:\LocalMachine\My | Format-List Subject, Thumbprint, NotAfter, HasPrivateKey
```
If it reports False, import again from the file that carries the key.
List the entries with the old thumbprint. Use the netsh list from the section above and keep it open until the check is done.

Repoint, check and clean up

Each IIS HTTPS binding from the list gets the new thumbprint.

Repoint each entry in place. netsh http update sslcert updates an existing binding for an IP address or host name and port; certhash names the certificate and certstorename the store (MY is the Personal store), and the reference lists the other parameters ^[1]:
```
netsh http update sslcert hostnameport=<name>:<port> certhash=<new thumbprint> certstorename=MY
```
Re-creating a binding is the other route: Remove-IISSiteBinding removes it, and New-IISSiteBinding adds it back with -CertificateThumbPrint and -CertStoreLocation ^[2]. Its -SslFlag parameter accepts the SNI flag; set it when you re-create an SNI binding ^[2].
Check every entry with netsh http show sslcert and the table below.
Remove the old certificate once no entry carries its thumbprint. Remove-Item on the certificate deletes it, and the DeleteKey parameter deletes the private key as well ^[3]. Keep the key until you no longer need it.

Check each binding afterwards

Check every IIS HTTPS binding on the list, not only the one you tested first.

Check each binding afterwards
What to check	Command	How to read it
Every entry in HTTP.sys	`netsh http show sslcert`	No entry carries the old thumbprint ^[1]
What the server sends on an IP and port binding	`openssl s_client -connect <host>:<port> -showcerts`	Shows the certificate list as the server sent it, and in TLS 1.3 the server's own certificate comes first ^[9] ^[10]
What it sends for a host name (server name indication)	`openssl s_client -connect <host>:<port> -servername <name> -showcerts`	`-servername` sets the SNI name. In OpenSSL 3.0, without it the name from `-connect` is used if it is a DNS name ^[9]
Which certificate it is	Save the first certificate as `leaf.pem`, then `openssl x509 -in leaf.pem -noout -serial -enddate`	The serial number and the notAfter date should match `SerialNumber` and `NotAfter` of the new certificate; `NotAfter` is given in local time ^[4] ^[9]
The Personal store afterwards	`Get-ChildItem Cert:\LocalMachine\My \| Format-List Subject, Thumbprint`	The old thumbprint is gone after step 6 ^[4]

Run the OpenSSL rows once per binding from your list.

FAQ

How do I replace an SSL certificate on IIS?

To replace an SSL certificate on IIS, put the new certificate in a store on the server, list the bindings that carry the old certificate with netsh http show sslcert, and point each at the new certificate thumbprint with netsh http update sslcert. Then read what the server sends on each binding and delete the old certificate.

How do I change the certificate on several IIS sites?

To replace the certificate on several IIS sites, list every entry with netsh http show sslcert, which displays all available bindings. Run netsh http update sslcert once per entry that still names the old certificate, with ipport or hostnameport as the entry requires. Each site binding is also visible through Get-IISSiteBinding.

Can I replace an IIS certificate without downtime?

The references used for this page do not say how connections that are already open are treated when an IIS HTTPS binding changes, so this page makes no promise either way. netsh http update sslcert is documented as updating an existing binding. To replace the old certificate on IIS, pick a time when a short interruption is acceptable, then confirm the result with netsh http show sslcert.

Do I need to create a new binding for the new certificate?

No. To replace the certificate on an IIS HTTPS site binding, netsh http update sslcert updates the binding that exists and takes the new certificate thumbprint. If you choose to re-create it, Remove-IISSiteBinding and New-IISSiteBinding do the removal and the addition.

Sources

Microsoft Learn, netsh http: show sslcert and update sslcert.
Microsoft Learn, IISAdministration cmdlets: New-IISSiteBinding, Get-IISSiteBinding and Remove-IISSiteBinding (learn.microsoft.com/en-us/powershell/module/iisadministration/).
Microsoft Learn, about_Certificate_Provider: Get-ChildItem with ExpiringInDays and Remove-Item with DeleteKey.
Microsoft Learn, X509Certificate2 properties HasPrivateKey, Thumbprint, NotAfter and SerialNumber (learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x509certificate2).
Microsoft Learn, IIS 8.0 Server Name Indication (SNI): SSL Scalability (learn.microsoft.com/en-us/iis/get-started/whats-new-in-iis-8/).
Microsoft Learn, IIS 8.0 Centralized SSL Certificate Support: SSL Scalability and Manageability (learn.microsoft.com/en-us/iis/get-started/whats-new-in-iis-8/).
Microsoft Learn, How to Set Up SSL on IIS and the binding element (learn.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis).
Microsoft Learn, IIS 7 Server Certificates, Complete Certificate Request (learn.microsoft.com/en-us/previous-versions/windows/it-pro/, page cc771816).
OpenSSL 3.0 manual, openssl-s_client and openssl-x509 (docs.openssl.org/3.0/man1/openssl-s_client/ and docs.openssl.org/3.0/man1/openssl-x509/).
RFC 8446, The Transport Layer Security (TLS) Protocol Version 1.3: section 4.4.2.