IIS SSL certificate expired

iis ssl certificate expired means the certificate bound to your site HTTPS binding still has a notAfter in the past—renew or import a replacement, attach it to the correct SNI binding, then reset IIS and confirm from outside the Windows server.

Windows Server teams running IIS terminate TLS for intranet apps, .NET APIs, and public marketing sites. iis ssl certificate expired surfaces as browser NET::ERR_CERT_DATE_INVALID errors, failed PowerShell Invoke-WebRequest calls, and legacy .NET ServicePointManager exceptions that mention the certificate is no longer valid.

The habitual mistake is importing a renewed PFX into the Local Machine store without rebinding the site to the new thumbprint. IIS continues presenting the old cert until bindings reference the updated hash, even when Certificate Manager shows a shiny replacement with future dates.

This guide covers external confirmation, locating the bound certificate, renewal via commercial CA or ACME tooling, binding updates for SNI and IP-based sites, controlled IIS reset, and handshake verification clients will see. Cross-check where IIS stores certificates when thumbprint hunting across stores grows confusing.

What to check

Confirm expiry on the public hostname with openssl or an external checker, not only in the Windows Certificates snap-in on the server. Load balancers and ARR farms may present different material than the origin IIS site you logged into.

For iis ssl certificate expired, capture which site ID and binding host:port:hostname combination fails. Shared IPs with SNI require matching the listener hostname, not merely renewing any cert in the store.

Distinguish machine certificate store My from Web Hosting if you use split stores. Domain registration problems block renewal validation but are separate from fixing an already-expired binding—still worth RDAP checks before the next cycle.

Compare thumbprint in IIS bindings with the cert openssl returns on the wire. Mismatch implicates ARR, another node in a farm, or CDN edge certs rather than the one site you updated.

Step-by-step

Confirm live expiry

HOST=www.example.com
echo | openssl s_client -connect "${HOST}:443" -servername "${HOST}" 2>/dev/null \
  | openssl x509 -noout -dates -serial -subject

From a Windows admin workstation without openssl, use certutil against a saved handshake or rely on live check for outsider proof.

List IIS HTTPS bindings

Import-Module WebAdministration
Get-WebBinding -Protocol https | Format-Table site, bindingInformation, certificateHash, certificateStoreName

Note certificateHash for the failing site. bindingInformation encodes IP:port:hostname for SNI.

Locate certificate in the store

Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq "THUMBPRINT_HERE" } |
  Select-Object Subject, NotAfter, Thumbprint, SerialNumber

Search also in Web Hosting if bindings reference that store name.

Renew or import replacement

Commercial renew: complete CA workflow, download PFX or CER plus key, import with mmc or Import-PfxCertificate into LocalMachine\My (include private key). ACME on Windows may use win-acme or another client—fix timer failures like Linux certbot using Certbot renew failed troubleshooting as conceptual parity for authorization errors.

Rebind site to new thumbprint

New-Item -Path "IIS:\SslBindings\0.0.0.0!443!www.example.com" -Thumbprint "NEW_THUMB" -SSLFlags 1
# or set-item for existing binding path; SSLFlags 1 enables SNI when required

Use exact binding path syntax your IIS version expects; export binding XML before bulk edits on farms.

Reset or recycle

iisreset /noforce
# lighter touch for some farms:
Restart-WebAppPool -Name "DefaultAppPool"

After reset, see reload IIS after SSL renewal for when recycle suffices versus full reset.

External re-check

Repeat openssl s_client; notAfter must advance and serial should change from the incident baseline.

Optional export for CA support

$cert = Get-ChildItem Cert:\LocalMachine\My\THUMBPRINT
Export-Certificate -Cert $cert -FilePath C:\temp\leaf.cer

Attach exported leaf and openssl transcripts when opening cases with your CA for reissue delays—not a substitute for binding fix, but shortens vendor back-and-forth.

How to read the output

openssl notAfter in GMT is the customer-visible expiry. Thumbprint is a short hash identifying the bound cert in IIS; serial in openssl should align with Certificate Manager details for the active binding.

Get-WebBinding certificateHash empty means IIS may inherit HTTP.sys binding from netsh or an outdated GUI state—repair bindings rather than only importing certs.

Subject CN and SAN extensions must cover the URL clients use. Future-dated cert with wrong name still fails hostname validation.

Common mistakes

Importing without Allow exportable private key when the site needs machine key access, then binding silently fails or serves an older still-bound cert.

Renewing on one node in an NLB farm while siblings keep expired thumbprints—automate binding updates across all nodes or terminate TLS on a single tier with synchronized deploy.

Using self-signed staging certs in production bindings after a DR restore from template.

Running iisreset during peak without connection drain when maintenance windows allow staggered binding changes first.

Forgetting HTTP to HTTPS redirect hostnames that use a different cert on port 443 than marketing expects—check both apex and www.

ARR reverse proxy to backend IIS with outdated upstream cert while edge looks healthy—validate the name users type, not only the edge listener.

Managed service accounts with constrained permissions sometimes cannot read renewed private keys if the previous cert left key ACLs attached to a removed service SID. After import, confirm the app pool identity still has read access to the machine key referenced by the binding.

Exchange or SharePoint dependencies on the same host may pin TLS to legacy protocol versions while marketing sites use separate bindings. Expiry on an obscure internal binding can break Office clients even when public openssl on www looks healthy—extend your binding inventory beyond customer-facing names.

Disaster recovery restores that reintroduce snapshot certificates often resurrect expired snapshots newer than backups were supposed to allow. Compare thumbprints against your CMDB expected hashes before declaring DR complete.

Developers testing self-signed localhost certificates occasionally export them into production stores during rushed demos. Production binding audits should flag issuer names that do not match your public CA policy.

When to use automation

Certificate Manager green icons do not replace live TLS proof. ssldays reads the certificate your hostname presents externally—issuer, SANs, trust chain, expiry—matching what browsers enforce.

Add monitored hostnames with threshold alerts at 30, 14, 7, and 1 days. Email on every plan; Slack and Discord webhooks on paid Starter and Pro. Free: 3 domains, daily checks; Starter 25 hourly; Pro 100 hourly. Combine with RDAP domain registration monitoring when dates are published so the next iis ssl certificate expired incident never starts at zero days. Continue at /register after bindings are corrected.