Replace an expiring certificate on IIS and RD Gateway

Windows doesn't swap a certificate just because a newer one is in the store. IIS and Remote Desktop Services each point at a specific certificate by its thumbprint, and keep using the old one until you change that. This runbook covers Windows Server 2019, 2022 and 2025.

1. Import the certificate into the computer store

Import the .pfx (certificate with private key) into Local Computer > Personal, not your user store:

GUI: run certlm.msc, right-click Personal > All Tasks > Import.
PowerShell:
```
$pw = Read-Host -AsSecureString 'PFX password'
Import-PfxCertificate -FilePath C:\certs\new.pfx -CertStoreLocation Cert:\LocalMachine\My -Password $pw
```
The key is imported as non-exportable unless you add -Exportable. Some automation (such as moving the certificate to other RDS servers) needs it exportable.

Check the result and note the new thumbprint:

Get-ChildItem Cert:\LocalMachine\My | Select-Object Subject, Thumbprint, NotAfter, HasPrivateKey

HasPrivateKey must be True. If it's False, you imported a .cer instead of the .pfx. If the chain isn't complete, import the intermediate into Intermediate Certification Authorities.

2. IIS

In IIS Manager, select the site > Bindings… > the https binding > Edit, choose the new certificate under SSL certificate, then OK. Repeat for every site and every HTTPS binding that used the old certificate.

IIS stores the binding in two places: its configuration and HTTP.sys. To see which certificate HTTP.sys actually uses:

netsh http show sslcert

The Certificate Hash must match the new thumbprint.

About Automatic Rebind: IIS 8.5 and later has Server Certificates > Enable Automatic Rebind of Renewed Certificate. It reacts to a Windows certificate renewal event (autoenrollment or a renewal done in Windows). A certificate from a public CA imported as a new .pfx is a new certificate, not a renewal, so don't rely on it to update the bindings.

3. Remote Desktop Services deployment

Server Manager > Remote Desktop Services > Overview > Tasks > Edit Deployment Properties > Certificates. For each of the four roles:

RD Connection Broker – Enable Single Sign On
RD Connection Broker – Publishing
RD Web Access
RD Gateway

select the role, choose Select existing certificate, browse to the .pfx, enter the password and click Apply.

PowerShell, once per role:

Set-RDCertificate -Role RDGateway -ImportPath C:\certs\new.pfx -Password $pw -ConnectionBroker cb.example.local -Force
Set-RDCertificate -Role RDWebAccess -ImportPath C:\certs\new.pfx -Password $pw -ConnectionBroker cb.example.local -Force
Set-RDCertificate -Role RDPublishing -ImportPath C:\certs\new.pfx -Password $pw -ConnectionBroker cb.example.local -Force
Set-RDCertificate -Role RDRedirector -ImportPath C:\certs\new.pfx -Password $pw -ConnectionBroker cb.example.local -Force

Check with Get-RDCertificate.

Standalone RD Gateway (not managed through a deployment): open RD Gateway Manager, right-click the server > Properties > SSL Certificate, and select the new certificate. Restarting the Remote Desktop Gateway service (Restart-Service TSGateway) makes sure it's used, but disconnects active sessions.

4. RDP on a single server

To change the certificate the RDP listener presents on a server that isn't part of an RDS deployment (the certificate must already be in Local Computer > Personal):

wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="<THUMBPRINT>"

On Windows Server 2025, where wmic may not be installed, use PowerShell:

Get-WmiObject -Class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices |
  Set-WmiInstance -Arguments @{SSLCertificateSHA1Hash = "<THUMBPRINT>"}

Type the thumbprint rather than copying it from the certificate dialog; the copy can include an invisible character that makes the command fail.

5. Check it from outside

openssl s_client -connect rdweb.example.com:443 -servername rdweb.example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -enddate -fingerprint -sha1

The SHA-1 fingerprint is the Windows thumbprint (with colons). Check every public name: RD Gateway, RD Web and each IIS site.

Automating it

With certificate lifetimes falling to 200 days in 2026 and 47 days by 2029, manual rebinding gets old fast. An ACME client for Windows, such as win-acme, can request the certificate, update IIS bindings and run a script for the RDS roles. Test its RDS script in a maintenance window before relying on it.

Check your domain

The free scan finds every certificate issued for your domain in the CT logs and flags hosts, like an RD Gateway, that still serve an older one after a renewal. See also Certificate renewed but not installed.

Replace an expiring certificate on IIS and Remote Desktop Services