Simple PowerShell Script To Update SSL Certificate Bindings On All IIS Sites

If you have to deal with updating SSL certificates, you probably feel my pain. Especially if you manage multiple web server farms with multiple Internet Information Service (IIS) sites. I mean it wasn't so bad a few years ago when you could buy a 3 year wildcard certificate and only deal with it every three years. Ever since Apple and Google basically forced everyone to move to 13 month certificates, this has been an administrators nightmare.

Until now that is. I found a really simple PowerShell script that goes through and matches the thumbprint from your old certificate on all bindings in IIS and replaces the bindings with the new certificate! This is particularly useful if you have a wildcard multi-domain certificate that you can use on all sites regardless of hostname!

Here it is!

$OLDCertificateThumbprint = "123456789abcdefgh1a2b3c4d5e6f7g8h9a1a1a1" $NEWCertificateThumbprint = "7a3b5a1g1a6a2j2a262a3343a333a5a64a4a4a4a" #Show bindings where the old certificate is in use Get-WebBinding | Where-Object { $_.certificateHash -eq $OLDCertificateThumbprint} | Format-Table #Select bindings where the old certificate is in use and attach the new certificate Get-WebBinding | Where-Object { $_.certificateHash -eq $OLDCertificateThumbprint} | ForEach-Object { Write-Host "Working on" $_ $_.RemoveSslCertificate() $_.AddSslCertificate($NEWCertificateThumbprint, 'My') } #Show bindings where the new certificate is in use Get-WebBinding | Where-Object { $_.certificateHash -eq $NEWCertificateThumbprint}

Just replace the OLDCertificateThumbprint and NEWCertificateThumbprint variables with the thumbprints from your respective SSL certificates!

Shout out to HeyThereSmileMore on GitHub!

At my company we added this as a step in an Octopus deployment to push it out to multiple servers at once. Octopus also gives you the ability to import certificates on multiple servers as well, so creating a deployment release for this is pretty straight forward.

What do you use to manage certificate updates on multiple servers? Let us know in the comments!