# Replace an expiring certificate on IIS and Remote Desktop Services

Windows doesn't swap a certificate just because a newer one is in the store.
IIS and Remote Desktop Services each point at a specific certificate by its
thumbprint, and keep using the old one until you change that. This runbook
covers Windows Server 2019, 2022 and 2025.

## 1. Import the certificate into the computer store

Import the `.pfx` (certificate with private key) into **Local Computer >
Personal**, not your user store:

- **GUI:** run `certlm.msc`, right-click **Personal > All Tasks > Import**.
- **PowerShell:**

  ```
  $pw = Read-Host -AsSecureString 'PFX password'
  Import-PfxCertificate -FilePath C:\certs\new.pfx -CertStoreLocation Cert:\LocalMachine\My -Password $pw
  ```

  The key is imported as non-exportable unless you add `-Exportable`. Some
  automation (such as moving the certificate to other RDS servers) needs it
  exportable.

Check the result and note the new thumbprint:

```
Get-ChildItem Cert:\LocalMachine\My | Select-Object Subject, Thumbprint, NotAfter, HasPrivateKey
```

`HasPrivateKey` must be `True`. If it's `False`, you imported a `.cer` instead
of the `.pfx`. If the chain isn't complete, import the intermediate into
**Intermediate Certification Authorities**.

## 2. IIS

In IIS Manager, select the site > **Bindings…** > the `https` binding >
**Edit**, choose the new certificate under **SSL certificate**, then OK.
Repeat for every site and every HTTPS binding that used the old certificate.

IIS stores the binding in two places: its configuration and HTTP.sys. To see
which certificate HTTP.sys actually uses:

```
netsh http show sslcert
```

The **Certificate Hash** must match the new thumbprint.

**About Automatic Rebind:** IIS 8.5 and later has **Server Certificates >
Enable Automatic Rebind of Renewed Certificate**. It reacts to a Windows
certificate renewal event (autoenrollment or a renewal done in Windows). A
certificate from a public CA imported as a new `.pfx` is a new certificate,
not a renewal, so don't rely on it to update the bindings.

## 3. Remote Desktop Services deployment

**Server Manager > Remote Desktop Services > Overview > Tasks > Edit
Deployment Properties > Certificates.** For each of the four roles:

- RD Connection Broker – Enable Single Sign On
- RD Connection Broker – Publishing
- RD Web Access
- RD Gateway

select the role, choose **Select existing certificate**, browse to the `.pfx`,
enter the password and click **Apply**.

PowerShell, once per role:

```
Set-RDCertificate -Role RDGateway -ImportPath C:\certs\new.pfx -Password $pw -ConnectionBroker cb.example.local -Force
Set-RDCertificate -Role RDWebAccess -ImportPath C:\certs\new.pfx -Password $pw -ConnectionBroker cb.example.local -Force
Set-RDCertificate -Role RDPublishing -ImportPath C:\certs\new.pfx -Password $pw -ConnectionBroker cb.example.local -Force
Set-RDCertificate -Role RDRedirector -ImportPath C:\certs\new.pfx -Password $pw -ConnectionBroker cb.example.local -Force
```

Check with `Get-RDCertificate`.

**Standalone RD Gateway** (not managed through a deployment): open **RD
Gateway Manager**, right-click the server > **Properties > SSL Certificate**,
and select the new certificate. Restarting the **Remote Desktop Gateway**
service (`Restart-Service TSGateway`) makes sure it's used, but disconnects
active sessions.

## 4. RDP on a single server

To change the certificate the RDP listener presents on a server that isn't
part of an RDS deployment (the certificate must already be in Local Computer >
Personal):

```
wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="<THUMBPRINT>"
```

On Windows Server 2025, where `wmic` may not be installed, use PowerShell:

```
Get-WmiObject -Class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices |
  Set-WmiInstance -Arguments @{SSLCertificateSHA1Hash = "<THUMBPRINT>"}
```

Type the thumbprint rather than copying it from the certificate dialog; the
copy can include an invisible character that makes the command fail.

## 5. Check it from outside

```
openssl s_client -connect rdweb.example.com:443 -servername rdweb.example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -enddate -fingerprint -sha1
```

The SHA-1 fingerprint is the Windows thumbprint (with colons). Check every
public name: RD Gateway, RD Web and each IIS site.

## Automating it

With certificate lifetimes falling to 200 days in 2026 and 47 days by 2029,
manual rebinding gets old fast. An ACME client for Windows, such as win-acme,
can request the certificate, update IIS bindings and run a script for the RDS
roles. Test its RDS script in a maintenance window before relying on it.

## Check your domain

The free scan finds every certificate issued for your domain in the CT logs
and flags hosts, like an RD Gateway, that still serve an older one after a
renewal. See also
[Certificate renewed but not installed](/guides/certificate-renewed-but-not-installed).

## Sources

- [Microsoft: Import-PfxCertificate](https://learn.microsoft.com/powershell/module/pki/import-pfxcertificate)
- [Microsoft: how to set up SSL on IIS](https://learn.microsoft.com/iis/manage/configuring-security/how-to-set-up-ssl-on-iis)
- [Microsoft: certificate rebind in IIS 8.5](https://learn.microsoft.com/iis/get-started/whats-new-in-iis-85/certificate-rebind-in-iis85)
- [Microsoft: deploy the RDS infrastructure (certificates)](https://learn.microsoft.com/windows-server/remote/remote-desktop-services/rds-deploy-infrastructure)
- [Microsoft: Set-RDCertificate](https://learn.microsoft.com/powershell/module/remotedesktop/set-rdcertificate)
- [Microsoft: Remote Desktop listener certificate configurations](https://learn.microsoft.com/troubleshoot/windows-server/remote/remote-desktop-listener-certificate-configurations)
- [win-acme: RDS example](https://win-acme.com/manual/advanced-use/examples/rds)

---
Source: https://nameward.app/guides/iis-rds-replace-certificate (updated 2026-10-29)