IIS Central Certificate Store expiry

iis certificate store expiry on Central Certificate Store layouts means the UNC-hosted PFX or PEM share still exposes a leaf past notAfter to every IIS site that references the same friendly name—even when the local machine store looks current.

Windows teams adopt CCS so dozens of sites bind one logical hostname without copying private keys per server. That convenience backfires at renewal: operators update one cluster node’s store while the share every farm member reads still serves the expiring leaf.

Central Certificate Store expiry incidents need a binding audit on each web server, a file check on the CCS share, and an external TLS probe on the hostname customers resolve—not only mmc snapshots on a single admin workstation.

Farm administrators should maintain a CSV mapping friendly names, UNC paths, public hostnames, and last renewed operator. iis certificate store expiry tickets without that mapping waste hours guessing which PFX file backs a marketing microsite. During mergers, legacy CCS shares from acquired companies often land in neglected DFS paths until a high-traffic brand fails.

Windows patch cycles that reboot CMS servers overnight can reorder DFS referrals, briefly pointing half a farm at read-only replicas with stale PFX copies. Monitor share replication latency alongside certificate dates.

What to check

Identify whether sites use IIS Central Certificate Store binding type versus a classic Local Machine store import. CCS paths appear as \share\folder\hostname.pfx in the IIS Manager binding dialog.

Confirm private key permissions on the share allow the IIS application pool identity to read renewed files. Silent ACL failures leave bindings pointing at metadata while TLS still loads the previous blob.

Measure the certificate users see through load balancers, Application Request Routing, and Azure Front Door. CCS fixes on premises do not refresh cloud-terminated certificates.

Pair iis certificate store expiry work with domain registration checks so the commercial reissue or Key Vault export can complete before deadlines.

Document friendly name to hostname mapping—CCS sites select certs by name, not by thumbprint visible in every UI.

Validate that offline certificate templates for internal CAs include exportable keys when CCS requires PFX with private material. HSM-backed templates without export force binding redesign mid-incident.

Step-by-step

List IIS bindings using CCS

Import-Module WebAdministration
Get-WebBinding | ForEach-Object {
  $b = $_
  [pscustomobject]@{
    Site   = $b.ItemXPath -replace '.*sites/@(\S+).*','$1'
    Host   = $b.bindingInformation
    Scheme = $b.protocol
    Cert   = $b.certificateHash
    Store  = $b.certificateStoreName
  }
} | Format-Table -AutoSize

Central Certificate Store bindings show store name WebHosting or CCS plugin identifiers depending on version; verify in IIS Manager when columns are ambiguous.

Inspect certificate dates on the share

$ccsPath = "\\ccsserver.example.com\centralcerts\www.example.com.pfx"
$password = Read-Host "PFX password" -AsSecureString
Import-PfxCertificate -FilePath $ccsPath -CertStoreLocation Cert:\LocalMachine\My -Password $password
Get-ChildItem Cert:\LocalMachine\My | Sort-Object NotAfter | Select-Object Subject, NotAfter, Thumbprint

Remove test imports after reading dates if policy forbids lingering copies on disk.

Compare external TLS

. .\Get-TlsCertificateExpiry.ps1
Get-TlsCertificateExpiry -HostName www.example.com -Port 443

Use the function from check SSL expiry with PowerShell or equivalent SslStream logic.

Deploy renewed PFX to the CCS share

1. Export renewed certificate with private key from your CA portal or internal PKI.
2. Copy to the UNC path during a change window, retaining a backup of the previous file.
3. Ensure the share’s Authorization tab grants IIS_IUSRS or domain web farm group read access.

Copy-Item .\www.example.com-new.pfx $ccsPath -Force

Refresh IIS

iisreset /noforce
# Or recycle specific app pools:
Restart-WebAppPool -Name "DefaultAppPool"

Some farms rely on CCS auto-reload; if TLS serial is unchanged after file replace, run iisreset deliberately.

Verify thumbprint on the wire

echo | openssl s_client -connect www.example.com:443 -servername www.example.com 2>/dev/null \
  | openssl x509 -noout -dates -serial -subject

Rolling node updates in load-balanced farms

Replace PFX on the CCS share first, then recycle IIS on one web server at a time while load balancer drains that node. Comparing openssl through the VIP after each node proves no member still serves the pre-change serial. ARR health probes should require HTTP 200 from a lightweight health page, not anonymous TLS alone, so drained nodes do not re-enter rotation prematurely.

How to read the output

NotAfter in the past on the external openssl capture confirms customer impact. serial must advance after a non-trivial reissue. Thumbprints in IIS should eventually match the served serial when CCS reload succeeded.

If PowerShell shows healthy dates but openssl does not, suspect ARR, WAF, or stale nodes in a load-balanced farm that have not picked up the share snapshot.

PFX import errors in the event log often cite password mismatch or missing private key—fix export options at the CA before repeating CCS copies.

Friendly name collisions cause IIS to bind the wrong CCS entry while operators stare at the correct file on disk under a different alias.

Common mistakes

Updating the certificate in Local Machine\Personal on one web node without replacing the CCS UNC object every binding references.

Forgetting to include intermediate certificates in the PFX, yielding chain errors that appear separate from iis certificate store expiry until clients hard-fail near expiry.

Running iisreset on all nodes simultaneously without drain, causing brief outages unrelated to TLS but blamed on renewal.

Assuming Azure Key Vault sync updates CCS shares automatically—many designs still require scripted copy jobs.

Renewing only the wildcard while sibling hostnames on dedicated CCS files remain expired.

Skipping external verification after change because mmc on the CMS server showed green status.

Delegated helpdesk accounts with CCS read-only access cannot replace PFX files—escalation paths should name the PKI team and web platform owners before expiry windows close. Misconfigured shared folder antivirus scanning sometimes locks PFX during copy, producing partial files that IIS still attempts to load.

When to use automation

Web farms multiply CCS bindings. Spreadsheet-driven renewal misses a single UNC filename every quarter until a major brand site fails.

ssldays watches live TLS on public hostnames—issuer, SAN coverage, chain trust, and notAfter—so you detect expired leaves at the edge, not only fresh files on a file server. RDAP adds registrar expiry where published, helping coordinate annual OV orders with shorter TLS cycles. Alerts at 30, 14, 7, and 1 days give time for staged iisreset windows. Email alerts ship on every plan; Slack and Discord webhooks on Starter and Pro. Free tier: three domains, daily checks; Starter 25 hourly; Pro 100 hourly.

Probe customer hostnames on live check after CCS deployment, then add them at register. Pair operations with fix an expired SSL certificate for rollback steps if a bad PFX lands on the share.