Reload IIS after SSL certificate renewal

reload iis ssl certificate updates mean refreshing HTTPS bindings to the new thumbprint and resetting IIS or recycling pools so HTTP.sys presents renewed notAfter values—not merely importing a PFX into the store.

Windows operators searching reload iis ssl certificate already imported a replacement or win-acme finished renew, yet browsers show yesterday's expiry. Certificate Manager looks healthy while SslBindings still reference the retired hash.

IIS caches binding state in configuration and HTTP.sys. Import alone does not switch listeners. You must attach the thumbprint to each site binding (or rely on automation that does), then recycle the worker processes that terminate TLS for that site.

This guide sequences binding updates, controlled reset, farm coordination, and openssl proof. Read IIS SSL certificate expired for full renew imports and IIS certificate paths for store layout.

What to check

Capture certificateHash from Get-WebBinding before and after intended change. Empty hash means manual repair is overdue.

For reload iis ssl certificate work on farms, verify every NLB node received binding updates—sticky sessions hide one bad node for hours.

Scheduled task history for win-acme should show success; task success without binding update still fails customers.

Compare openssl serial to MMC serial for the thumbprint listed on the binding—mispointed ARR upstreams mimic reload gaps.

Step-by-step

Current binding state

Import-Module WebAdministration
Get-WebBinding -Name "Default Web Site" -Protocol https | Format-List *

Adjust site name to the production site.

Import or renew completes—note new thumbprint

Get-ChildItem Cert:\LocalMachine\My | Sort-Object NotAfter -Descending | Select-Object -First 5 Subject, Thumbprint, NotAfter

Update binding

$site = "Default Web Site"
$binding = "*:443:www.example.com"
$thumb = "NEWTHUMBPRINTWITHOUTSPACES"
Remove-WebBinding -Name $site -Protocol https -HostHeader "www.example.com"
New-WebBinding -Name $site -Protocol https -Port 443 -HostHeader "www.example.com" -SslFlags 1
(Get-Item "IIS:\SslBindings\0.0.0.0!443!www.example.com").Thumbprint = $thumb

Syntax varies by IIS version; export applicationHost.config backup first.

Reset IIS

iisreset /noforce

For stateless APIs, consider stopping the site, updating bindings, then starting to drain gently during maintenance windows.

Farm rollout

Repeat binding update on each node or run shared deployment script. Drain NLB before iisreset on one member at a time if health probes allow.

External verify

echo | openssl s_client -connect www.example.com:443 -servername www.example.com 2>/dev/null | openssl x509 -noout -serial -dates

If ACME renewal failed before import, triage with Certbot renew failed troubleshooting concepts adapted to win-acme logs.

How to read the output

openssl serial must match Certificate Manager details for the thumbprint on the binding you updated.

notAfter advancing without serial change may mean you bound an reissued cert with uncommon serial reuse—rare; double-check you selected the intended import.

iisreset success banner is not proof—always openssl the customer hostname.

Common mistakes

win-acme updated store but script lacked permission to touch SslBindings on secondary sites.

Forgot to set SSLFlags for SNI after cloning bindings from legacy templates.

iisreset during long uploads without change window approval.

Updated admin site binding while customer site on same IP still uses expired hash.

ARR publishes healthy while origin still expired—reload both tiers when architecture demands.

Using netsh http delete sslcert without recording old IP:port mappings—document before destructive netsh edits.

Performance counters showing rising authentication failures after a renew often mean bindings updated on only one node while NLB still pins users to siblings with old thumbprints. Drain and verify per node rather than declaring farm success from MMC on the primary.

Security baselines that require private key attestation paperwork sometimes delay binding updates until compliance approves the new thumbprint. Track approval timelines separately from renew completion so operations does not assume import equals presentation.

Kemp or F5 layers in front of IIS may still publish an expired backup cert when admin uploads to the ADC but not to origin bindings. clarify architecture diagrams in tickets so reload iis ssl certificate work targets the layer that actually serves the name customers type.

Scheduled task accounts with log on as batch only may run win-acme but fail binding scripts that require administrator SslBindings rights. Align task principals with least privilege that still permits binding mutation.

After major Windows updates, HTTP.sys occasionally needs iisreset twice before new thumbprints present consistently—a rare edge case worth documenting for your standard image version when first observed.

Developers using IIS Express locally should not assume Express binding behavior matches full IIS on Server—document differences so production reload iis ssl certificate procedures are not copied from workstations incorrectly.

Insurance and legal teams sometimes request proof of annual reload testing. Store timestamped openssl captures tied to change tickets in your records retention system alongside win-acme logs.

Hybrid cloud teams may renew on premises but publish DNS to cloud load balancers terminating TLS elsewhere. Reload IIS only when IIS actually presents the failing cert; otherwise escalate to the cloud binding team with the same evidence package.

Executive reporting dashboards counting open cert tickets should distinguish renew complete from reload verified. Splitting those states prevents false green status when customers still see expired material.

Post-incident reviews after P1 browser warnings should list hook owner, hook runtime, and last successful external serial proof. Organizational learning matters as much as tooling for reload iis ssl certificate maturity.

When to use automation

Binding drift across nodes breaks trust randomly by session. Live TLS monitoring on each public hostname catches missed reload iis ssl certificate steps.

Use /check, then schedule /register with 30, 14, 7, and 1 day thresholds. ssldays validates issuer, SANs, chain, expiry from outside. Email all plans; Slack and Discord webhooks on paid tiers. Free 3 daily; Starter 25 hourly; Pro 100 hourly. RDAP domain expiry guards validation for the next win-acme run.