Where IIS stores SSL certificates and renewal

iis ssl certificate path clarity means knowing which certificate store holds your keypair, which thumbprint IIS bindings reference, and where ACME clients write renewed PFX or PEM material before listeners pick it up.

On Windows, there is no single Apache-style PEM directory. iis ssl certificate path questions usually mean tracing from filesystem exports into Certificate Store, then into IIS SslBindings metadata under applicationHost.config and site XML. Linux teammates map Lets Encrypt live trees; IIS admins map thumbprints.

Renewal succeeds in ACME logs but sites stay expired when bindings still reference the previous thumbprint. Path discipline here is store plus binding discipline, not only copying files to C:\certs.

This guide explains default store locations, how IIS references certificates, win-acme and commercial renewal flows, and the reset order after you attach the new hash. Pair with IIS SSL certificate expired when users already see date errors.

What to check

Document for each public hostname: thumbprint on the HTTPS binding, physical store (LocalMachine\My vs Web Hosting), whether the private key is exportable, and any win-acme renewal identifier if automation handles the site.

For iis ssl certificate path reviews, export binding lists from every node if NLB spreads traffic—nodes diverge silently after one-off MMC imports.

Filesystem folders like C:\ProgramData\win-acme or custom C:\ssl\incoming are staging areas; IIS serves from store bindings, not directly from loose CER files unless something imports them on each renew.

Confirm intermediate chain completeness when importing commercial bundles—clients fail when Intermediate store lacks signers even if leaf notAfter looks fine.

Step-by-step

Enumerate bindings and stores

Import-Module WebAdministration
Get-WebBinding -Protocol https | Select-Object item, bindingInformation, certificateHash, certificateStoreName
Get-ChildItem Cert:\LocalMachine\My | Sort-Object NotAfter | Select-Object Subject, NotAfter, Thumbprint -Last 15

Repeat for Cert:\LocalMachine\WebHosting when used.

Map thumbprint to files (win-acme)

& "C:\Program Files\win-acme\wacs.exe" --list

Note renewal IDs and default paths documented in win-acme settings.json for cache and certificate orders.

Import commercial PFX to intended store

$pwd = ConvertTo-SecureString -String "PFX_PASSWORD" -Force -AsPlainText
Import-PfxCertificate -FilePath "C:\ssl\incoming\www.example.com.pfx" -CertStoreLocation Cert:\LocalMachine\My -Password $pwd

Record returned thumbprint immediately; update bindings before the old cert expires.

Update SNI binding

$thumb = (Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -match "example.com" } | Sort-Object NotAfter -Descending | Select-Object -First 1).Thumbprint
New-Item -Path "IIS:\SslBindings\!443!www.example.com" -Thumbprint $thumb -SSLFlags 1

Adjust IP prefix in binding paths to match existing bindingInformation patterns on your server version.

Apply and recycle

iisreset /noforce

Follow reload IIS after SSL renewal for farm-wide sequencing.

Verify path to wire alignment

echo | openssl s_client -connect www.example.com:443 -servername www.example.com 2>/dev/null | openssl x509 -noout -serial -dates

Serial should match the newly imported cert details in MMC.

How to read the output

Thumbprint is 40 hex characters without spaces in PowerShell objects; GUI may show spaced pairs—compare consistently.

NotAfter in Certificate Manager uses local time display; openssl prints GMT—convert before arguing about one-day drift.

bindingInformation IP:port:hostname tells which SNI label receives which hash. Blank hostname on IP-based bindings uses the catch-all certificate for that IP.

win-acme list output ties hostnames to renewal profiles and reveal scheduled task names for unattended renew.

Common mistakes

Leaving expired cert in the store while binding still points at it because a new import created a second cert with the same friendly name—sort by NotAfter and bind explicitly.

Importing only .cer public half without private key—bindings require machine-keyable private material in My.

Copying PFX to a share for DR but never importing on passive nodes before failover drills.

Assuming Centralized SSL in newer IIS versions auto-updated all sites when only one site binding was registered in the feature wizard.

Editing applicationHost.config by hand without understanding locking sections—changes revert on next GUI save.

Using filesystem PEM tools on Windows without converting to PFX IIS can consume—use openssl export flows documented for your CA when needed.

Lifecycle automation should store thumbprint hashes in your service catalog alongside DNS names, not only friendly certificate subjects that repeat across renewal generations. Subjects alone are ambiguous after your fifth consecutive multidomain cert.

Hybrid identity teams may store SAML signing certs near TLS web certs in the same store during audits. Document which thumbprints belong to browser TLS versus federation metadata so a federation rotation does not accidentally rebind the wrong hash to port 443.

GPO-deployed trust anchors are unrelated to IIS site bindings but support tickets often conflate them. When clients fail trust, confirm whether the fix belongs in Intermediate stores for chain trust or SslBindings for presentation—path language differs between those layers.

Long-lived DR scripts that copy PFX to warm standby folders must also schedule binding imports on boot. Cold standby with files present but no HTTP.sys mapping still yields expired errors after DNS failover.

Annual compliance reviews should sample random production bindings and compare to win-acme scheduled tasks still enabled. Disabled tasks leave files updating on manual runs while production silently ages.

Vendor penetration tests sometimes request private key proof paths without understanding IIS binding mechanics. Respond with thumbprint mapping documents rather than emailing PFX files to third parties.

Keep a one-page runbook summarizing store names, typical win-acme cache locations, and the PowerShell cmdlets your team standardizes on. Consistent vocabulary reduces handoff friction for iis ssl certificate path audits.

When to use automation

Thumbprint inventories rot quickly on active farms. External live TLS monitoring proves each hostname still negotiates the cert you expect after renew imports and binding scripts run.

Use /check for one-shot proof, then register hostnames for 30, 14, 7, and 1 day alerts. ssldays evaluates issuer, SANs, chain, and notAfter from the public internet. Email alerts on all plans; Slack and Discord webhooks on Starter and Pro. Free monitors 3 domains daily; Starter 25 hourly; Pro 100 hourly. Layer RDAP domain expiry when available so iis ssl certificate path work is not undermined by registrar lapses during the next win-acme validation.