I have some IIS servers, which have multiple sites with multiple bindings and each binding is used with a different certificate.

Before to open this post I tried to search a solution looking on google, but I can’t find a solution to update the binding of the site with that certificate.

I created the following PowerShell script, but it update every bindings in the site.

param (
    [Parameter(Mandatory = $true)]
    #subject name in format CN=*.marketings.contoso.com without quotes
    [string]$subjectname
)


Import-Module WebAdministration

#certificates in LocalMachine/My
$Certificates = Get-ChildItem -Path cert:LocalMachineMy

#Get last certiticate based by name and expiration
$LastCertificate = $Certificates | Where-Object { $_.Subject -like "$subjectname*" }  | Sort-Object NotAfter -Descending | Select-Object -First 1

#I get the existing SSL bindings in IIS
$sitesBindings = Get-ChildItem IIS:SSLBindings

#This variable will be used into the loop
$Sites = @()

#Replace "*" with "_" for the output
$subject = $subjectname.Replace("*","_")

#Loop to obtain the Bindings
foreach ($siteBinding in $sitesBindings) {
    
    #creation of a variable named $siteThumbprint starting from the value of the loop $siteBinding + Thumbprint
    $siteThumbprint = $siteBinding.Thumbprint
    
    #creation of a variable named $siteCertificate checking the path LocalMachineMy with variable $siteThumbprint
    $siteCertificate = Get-Item -Path "cert:LocalMachineMy$siteThumbprint"

    #Log Directory
    $OutDir = "C:TempReport"

    #if the certificate subject is equal to the subject of $LastCertificate and if the thumbprint contained in $siteThumbprint is different from the thumbprint present in the last certificate
    if ($siteCertificate.Subject.Split()[0] -eq $LastCertificate.Subject.Split()[0] -and $siteThumbprint -ne $LastCertificate.Thumbprint) {
        
        #Write the ouptut
        $output = "OK-the_binding_of_the_site-$($siteBinding.Sites.Value)-is_equal_at-$($subject)_and_will_be_update"
        
        #inserting the names of the sites whose value is true into the $sites array variable
        $Sites += $bindingInformation.Sites.Value
       
        #Check if $OutDir exist
        if (Test-Path -Path $OutDir) {
            #create a  file in format date/month/year in txt in the folder $OutDir
            $outputpath = Join-Path -Path $OutDir  -ChildPath ((get-date -Format "dd-MM-yyyy-HH_mm").ToString() + "_" + $output + ".txt")
            Out-File -FilePath $outputpath -Append
        }
        else {
            #if directory not exist it will be create
            New-Item -ItemType Directory -Path $OutDir -Force
            #creates a  file in format date/month/year in txt in the folder $OutDir
            $outputpath = Join-Path -Path $OutDir  -ChildPath ((get-date -Format "dd-MM-yyyy-HH_mm").ToString() + "_" + $output + ".txt")
            Out-File -FilePath $outputpath -Append
        }

    }
    #if the certificate subject is NOT the same as the subject of $LastCertificate and if the thumbprint contained in $siteThumbprint is different from the thumbprint present in the last certificate
    else {
        #verity if $OutDir exist
        if (Test-Path -Path $OutDir) {
            #if it exists, create the file with date/month/year in txt format in the $OutDir folder
            $alternativeoutput = "KO-he_binding_of_the_site-$($siteBinding.Sites.Value)_is-equal_at-$($subject)_and_will_NOT_be_update"
            $Newpath = Join-Path -Path $OutDir -ChildPath ((get-date -Format "dd-MM-yyyy-HH_mm").ToString() + "_" + $alternativeoutput + ".txt") 
            Out-File -FilePath $Newpath -Append
        }
        #verity if $OutDir exist
        else {
            #if directory not exist it will be create
            New-Item -ItemType Directory -Path $OutDir -Force
            #creates the file with date/month/year in txt format in the $OutDir folder
            $alternativeoutput = "KO-he_binding_of_the_site-$($siteBinding.Sites.Value)_is-equal_at-$($subject)_and_will_NOT_be_update"
            $Newpath = Join-Path -Path $OutDir -ChildPath ((get-date -Format "dd-MM-yyyy-HH_mm").ToString() + "_" + $alternativeoutput + ".txt")
            Out-File -FilePath $Newpath -Append
        }
    }
}


#Loop to update the binding
foreach ($Site in $Sites) {
    #Adds binding to sites that use the https protocol without specifying the port
    (Get-WebBinding -Name $Site -Protocol "https").AddSslCertificate($LastCertificate.Thumbprint, "My")
}

I also tried to update manually:

set-WebBinding -Name CRM -HostHeader CRM.marketing.contoso.com  -Port 433 -PropertyName "CertificateHash" -Value $LastCertificate.Thumbprint 

but I receive “WARNING: Target configuration object ‘/system.applicationHost/sites/site[compare-string-ordinal(@name,’CRM’,true())=0]/bindings/binding[(@protoco
l=’http’ or @protocol=’https’) and compare-string-ordinal(@bindingInformation,’*:433:CRM.marketing.contoso.com’,true())=0] is not found at path ‘MACHINE/WEBROOT/APPHOST'”