Update all bindings in IIS to replace an expiring SSL Certificate with a new one

Question

I wish to iterate through all IIS bindings and find any that use a particular certificate (the one that is expiring) and replace them all with a new certificate. Without changing anything else about the binding.

Powershell seems the obvious solution to this.

Answer 1

I found a great script to find any IIS bindings that have a particular 'old thumbprint', and replace the cert with the new cert specified by it's thumbprint. The original script I found here (archived here)

This works given the new cert is already installed.

Removing a bit of cruft the script boils down to this:

$OldThumbprint = "########################################"
$NewThumbprint = "########################################"

Get-WebBinding | Where-Object { $_.certificateHash -eq $OldThumbprint} | ForEach-Object {
    Write-Host "Replacing Cert For "  $_ 
    $_.RemoveSslCertificate()
    $_.AddSslCertificate($NewThumbprint, 'My')
}