The SSL certificate must be renewed or replaced in time after it expires to avoid security warnings affecting user access. To determine whether renewal or replacement is required, you can check the certificate status and expiration time in IIS. If it is close to expiration (usually 30 days in advance), it needs to be renewed. If it has expired or there are changes in the domain name or service provider, it needs to be replaced. The renewal operation includes finding the corresponding certificate in IIS and selecting "Renew", selecting to use the same key or generate a new key according to your needs, and submitting CA for review and downloading and installing. To replace a new certificate, you need to apply for a new certificate and import IIS, update the site binding configuration, and ensure that the domain name matches and the private key permissions are correct, and bring out the private key during migration. Other precautions include: self-signed certificates are not suitable for external services; pay attention to private key permissions when multiple servers are updated simultaneously; check HTTPS redirection rules; use the certutil command to view certificate information; third-party CA certificates need to be operated manually and do not support automatic renewal function.

If the SSL certificate is not processed in time after it expires, the website will have a security warning, affecting user access and trust. There are two main ways to solve this problem: renew or replace the certificate. Below are some practical operation suggestions.

How to determine whether a certificate needs to be renewed or replaced

When managing SSL certificates in IIS, you must first confirm the status of the current certificate. The expiration time of each certificate can be viewed through the "Server Certificate" function. If you find that a certificate is about to expire (usually about 30 days in advance), you need to prepare for renewal; if it has expired, you may need to reapply and install a new certificate.

Common phenomena include:

• The browser prompts "This site connection is not secure"
• Certificate error occurred while accessing using https://
• There is a warning in the system log that the relevant SSL certificate is about to expire soon

If it is a self-signed certificate for internal testing, a new one can be generated directly; but if it is a formal certificate issued by a trusted CA, it must be renewed through a formal process.

Specific operations for renewing existing certificates

If you previously applied for an SSL certificate through a certificate authority and want to retain the original domain name and key information, you can choose to renew it . The specific steps are as follows:

• Open IIS Manager and enter the "Server Certificate" page
• Find the certificate that is about to expire, right-click and select "Renew"
• Select "Use the same key" or "Generate new key" according to the wizard
• Submit it to CA for review after completion
• Download and install a new certificate

It should be noted that some CAs require you to manually download new .cer files and import them, which cannot be completely automatically completed. In addition, if you choose to generate a new key during the renewal process, the original private key will no longer be applicable. It is necessary to ensure that the website configuration bound to the certificate is also updated simultaneously.

Scenarios and practices for replacing them with new certificates

Sometimes you may not want to renew your original certificate, such as changing the domain name, changing the service provider, or having problems with the previous certificate. You can choose to replace it at this time.

The operation process is roughly as follows:

• Apply and obtain a new SSL certificate (including .cer or .p7b files)
• Open "Server Certificate" in IIS and click "Import"
• Select the certificate file and specify the private key storage location
• After the import is completed, replace it with a new certificate in the site binding.

A few points to pay special attention to in this case:

• Make sure the new certificate matches the bound domain name
• The private key permissions must be set correctly, otherwise the "Certificate Not Found" problem will occur.
• If it is a certificate migrated from another server, it is best to bring out the private key and export it together.

If it is a wildcard certificate or SAN certificate, also check whether all subdomains that need to be protected are covered.

Small details reminder in different situations

In actual operation, there are some things that are easy to ignore:

• Although the self-signed certificate is simple, the browser will report an error and is not suitable for external services.
• When deploying the same certificate on multiple servers, pay attention to synchronous updates and private key permissions.
• Some HTTPS redirect rules depend on certificate status. Remember to check after update
• You can use certutil -viewstore -user my command to view the local certificate details

In addition, the automatic certificate renewal function that comes with Windows Server is only suitable for enterprise CAs in domain environments. If it is a certificate issued by a third-party CA, it still needs to be operated manually.

Basically all of this is it. Choose renewal or replacement as needed. Just pay attention to the private key and binding configuration without errors.

The above is the detailed content of Renewing or Replacing Expired SSL Certificates in IIS. For more information, please follow other related articles on the PHP Chinese website!