IIS Certificate Binding & Troubleshooting: Complete Guide

IIS certificate binding looks straightforward in the GUI — import a PFX, select it in the dropdown, done. Until it isn’t. Bindings disappear after reboot. The certificate doesn’t show in the dropdown. Port 443 conflicts block new sites. PowerShell commands fail with cryptic errors about logon sessions.

This guide covers the full lifecycle: importing certificates, creating bindings (GUI and PowerShell), SNI configuration for multiple sites, wildcard certificate management, and systematic troubleshooting for every common failure mode.

IIS Certificate Binding Architecture

Importing a PFX Certificate

Via IIS Manager (GUI)

1. Open IIS Manager → Select the server node
2. Double-click Server Certificates
3. Click Import… in the Actions pane
4. Browse to your .pfx file
5. Enter the PFX password
6. Select certificate store: Web Hosting (recommended for many certs) or Personal
7. Check Allow this certificate to be exported if you need to move it later

Via PowerShell

# Import PFX to the Local Machine Personal store
$pfxPassword = ConvertTo-SecureString -String "YourPfxPassword" -Force -AsPlainText
Import-PfxCertificate -FilePath "C:\certs\example.com.pfx" -CertStoreLocation "Cert:\LocalMachine\My" -Password $pfxPassword

# Verify import
Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -like "*example.com*" } | Format-List Subject, Thumbprint, NotAfter, HasPrivateKey

Via certutil

certutil -f -p "YourPfxPassword" -importpfx "C:\certs\example.com.pfx"

Critical: The certificate must have HasPrivateKey = True. Without the private key, it won’t appear in the IIS binding dropdown.

Creating SSL Bindings

Via IIS Manager (GUI)

1. Select your site in IIS Manager
2. Click Bindings… in the Actions pane
3. Click Add…
4. Type: https
5. IP address: All Unassigned (or specific IP)
6. Port: 443
7. Host name: app.example.com (enables SNI)
8. Check Require Server Name Indication (for SNI)
9. Select your certificate from the dropdown
10. Click OK

Via PowerShell

# Get the certificate thumbprint
$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -like "*example.com*" }
$thumbprint = $cert.Thumbprint

# Create the IIS binding
New-WebBinding -Name "MyWebsite" -Protocol "https" -Port 443 -HostHeader "app.example.com" -SslFlags 1

# Bind the certificate to the site (SNI-enabled)
$binding = Get-WebBinding -Name "MyWebsite" -Protocol "https" -HostHeader "app.example.com"
$binding.AddSslCertificate($thumbprint, "My")

Via netsh (Low-Level HTTP.sys Binding)

:: IP-based binding (no SNI)
netsh http add sslcert ipport=0.0.0.0:443 certhash=THUMBPRINT_HERE appid={4dc3e181-e14b-4a21-b022-59fc669b0914} certstorename=MY

:: SNI-based binding (hostname-specific)
netsh http add sslcert hostnameport=app.example.com:443 certhash=THUMBPRINT_HERE appid={4dc3e181-e14b-4a21-b022-59fc669b0914} certstorename=MY

The appid is a GUID that identifies the application. For IIS, you can use any valid GUID — it’s used for logging purposes.

SNI Configuration for Multiple Sites

SNI (Server Name Indication) allows multiple HTTPS sites on the same IP and port. Each site gets its own certificate based on the hostname the client requests.

PowerShell — Multiple Sites on Port 443

# Site 1
New-WebBinding -Name "AppSite" -Protocol "https" -Port 443 -HostHeader "app.example.com" -SslFlags 1
$cert1 = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -like "*app.example.com*" }
(Get-WebBinding -Name "AppSite" -Protocol "https" -HostHeader "app.example.com").AddSslCertificate($cert1.Thumbprint, "My")

# Site 2
New-WebBinding -Name "ApiSite" -Protocol "https" -Port 443 -HostHeader "api.example.com" -SslFlags 1
$cert2 = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -like "*api.example.com*" }
(Get-WebBinding -Name "ApiSite" -Protocol "https" -HostHeader "api.example.com").AddSslCertificate($cert2.Thumbprint, "My")

# Site 3 — default (no SNI, catches unmatched requests)
New-WebBinding -Name "DefaultSite" -Protocol "https" -Port 443 -SslFlags 0
$certDefault = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -like "*example.com*" }
(Get-WebBinding -Name "DefaultSite" -Protocol "https").AddSslCertificate($certDefault.Thumbprint, "My")

SslFlags values:

• 0 — No SNI (IP-based binding)
• 1 — SNI required (hostname-based)
• 2 — Central Certificate Store (CCS)
• 3 — SNI + CCS

Wildcard Certificate Binding

Wildcard certificates (*.example.com) work with SNI but require specific configuration:

# Import wildcard cert
$pfxPassword = ConvertTo-SecureString -String "password" -Force -AsPlainText
$wildcardCert = Import-PfxCertificate -FilePath "C:\certs\wildcard.example.com.pfx" -CertStoreLocation "Cert:\LocalMachine\My" -Password $pfxPassword

# Bind to multiple sites using the same wildcard cert
$sites = @("app.example.com", "api.example.com", "admin.example.com")

foreach ($hostname in $sites) {
    # Assumes sites already exist
    New-WebBinding -Name $hostname -Protocol "https" -Port 443 -HostHeader $hostname -SslFlags 1
    $binding = Get-WebBinding -Name $hostname -Protocol "https" -HostHeader $hostname
    $binding.AddSslCertificate($wildcardCert.Thumbprint, "My")
}

# IIS bindings
Get-WebBinding -Protocol "https" | Format-Table bindingInformation, certificateHash, sslFlags

# HTTP.sys bindings (lower level — shows everything)
netsh http show sslcert

# Export all HTTPS bindings to CSV
Get-WebBinding -Protocol "https" | Select-Object @{
    Name='Site'; Expression={ $_.ItemXPath -replace ".*@name='([^']+)'.*", '$1' }
}, bindingInformation, certificateHash, sslFlags | Export-Csv -Path "C:\backup\iis-bindings.csv" -NoTypeInformation

$oldThumbprint = "OLD_CERT_THUMBPRINT_HERE"
$newThumbprint = "NEW_CERT_THUMBPRINT_HERE"

# Find all bindings using the old certificate
$bindings = Get-WebBinding -Protocol "https" | Where-Object { $_.certificateHash -eq $oldThumbprint }

foreach ($binding in $bindings) {
    $siteName = $binding.ItemXPath -replace ".*@name='([^']+)'.*", '$1'
    $hostHeader = ($binding.bindingInformation -split ':')[2]

    Write-Host "Updating binding for $siteName ($hostHeader)"

    # Remove old binding certificate
    $binding.RemoveSslCertificate()

    # Add new certificate
    $binding.AddSslCertificate($newThumbprint, "My")
}

Write-Host "Updated $($bindings.Count) binding(s)"

# Remove via IIS cmdlets
Remove-WebBinding -Name "MyWebsite" -Protocol "https" -Port 443 -HostHeader "app.example.com"

# Remove via netsh (if IIS cmdlet doesn't clean up HTTP.sys)
netsh http delete sslcert hostnameport=app.example.com:443

# Verify certificate location
Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq "YOUR_THUMBPRINT" }

# Find the private key file
$cert = Get-ChildItem Cert:\LocalMachine\My\YOUR_THUMBPRINT
$keyPath = $cert.PrivateKey.CspKeyContainerInfo.UniqueKeyContainerName
$fullPath = "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\$keyPath"

# Grant IIS_IUSRS read access
icacls $fullPath /grant "IIS_IUSRS:(R)"

:: List current HTTP.sys bindings
netsh http show sslcert

:: Delete orphaned binding
netsh http delete sslcert ipport=0.0.0.0:443

:: Re-add with correct thumbprint
netsh http add sslcert ipport=0.0.0.0:443 certhash=THUMBPRINT appid={4dc3e181-e14b-4a21-b022-59fc669b0914} certstorename=MY

# Check if private key exists
$cert = Get-ChildItem Cert:\LocalMachine\My\YOUR_THUMBPRINT
$cert.HasPrivateKey  # Must be True

# If using CNG key storage
$cert.PrivateKey  # Should not be null

# Re-import the PFX with exportable flag
$pfxPassword = ConvertTo-SecureString -String "password" -Force -AsPlainText
Import-PfxCertificate -FilePath "C:\certs\cert.pfx" -CertStoreLocation "Cert:\LocalMachine\My" -Password $pfxPassword -Exportable

# Diagnose why a cert isn't showing
$cert = Get-ChildItem Cert:\LocalMachine\My\YOUR_THUMBPRINT
Write-Host "Has Private Key: $($cert.HasPrivateKey)"
Write-Host "Not After: $($cert.NotAfter)"
Write-Host "EKU: $($cert.EnhancedKeyUsageList | ForEach-Object { $_.FriendlyName })"

# Find what's using port 443
netsh http show sslcert ipport=0.0.0.0:443

# Find the process
netstat -ano | findstr ":443"

# Check if another site has a non-SNI binding on 443
Get-WebBinding -Protocol "https" -Port 443 | Where-Object { $_.sslFlags -eq 0 }

# Remove the conflicting non-SNI binding
Remove-WebBinding -Name "ConflictingSite" -Protocol "https" -Port 443

# Re-create with SNI
New-WebBinding -Name "ConflictingSite" -Protocol "https" -Port 443 -HostHeader "conflicting.example.com" -SslFlags 1

# Enable CCS feature
Install-WindowsFeature Web-CertProvider

# Configure CCS
Set-WebCentralCertProvider -CertStoreLocation "\\fileserver\certs" -UserName "DOMAIN\svc-iis-certs" -Password "ServiceAccountPassword" -PrivateKeyPassword "PfxPassword"

# Enable CCS
Set-WebCentralCertProvider -Enabled $true

# Create binding using CCS
New-WebBinding -Name "MyWebsite" -Protocol "https" -Port 443 -HostHeader "app.example.com" -SslFlags 3

# Disable TLS 1.0
New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" -Force
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" -Name "Enabled" -Value 0 -Type DWord
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" -Name "DisabledByDefault" -Value 1 -Type DWord

# Disable TLS 1.1
New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" -Force
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" -Name "Enabled" -Value 0 -Type DWord
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" -Name "DisabledByDefault" -Value 1 -Type DWord

# Enable TLS 1.2 (usually already enabled)
New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" -Force
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" -Name "Enabled" -Value 1 -Type DWord

# Enable TLS 1.3 (Windows Server 2022+)
New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server" -Force
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server" -Name "Enabled" -Value 1 -Type DWord

# On old server — export
Get-ChildItem Cert:\LocalMachine\My\THUMBPRINT | Export-PfxCertificate -FilePath "C:\migration\cert.pfx" -Password (ConvertTo-SecureString -String "MigrationPwd" -Force -AsPlainText)

# On new server — import and bind
Import-PfxCertificate -FilePath "C:\migration\cert.pfx" -CertStoreLocation "Cert:\LocalMachine\My" -Password (ConvertTo-SecureString -String "MigrationPwd" -Force -AsPlainText)

netsh http show sslcert