Chris's questions

Situation: an IIS 7.5 server with 30+ sites and 10+ certificates and a few certificates may be obsolete. Obsolete means they're not binded to the ip:port of any site on IIS.

I could check each site bindings through the GUI, but that seems not the fastest way.

With what command(s) can I get a list of sites using a certain certificate given its common name like *.example.com. I think I need at least netsh http show sslcert, but that output only shows the certificate hash and no site names.

I have 3 websites: aaa.my-domain.com, bbb.my-domain.com and ccc.my-domain.com all using a single wildcard certificate *.my-domain.com on IIS 7.5 Windows Server 2008R2 64-bit. That certificate expires in a month and I have a new wildcard certificate *.my-domain.com on my server ready.

I want all those domains to use the new wildcard certificate without noticeable downtime.

I tried the usual through the UI starting with replacing the certificate for aaa.my-domain.com:

But when I press OK, I get the following error:

--------------------------- Edit Site Binding ---------------------------

At least one other site is using the same HTTPS binding and the binding is configured with a different certificate. Are you sure that you want to reuse this HTTPS binding and reassign the other site or sites to use the new certificate?

--------------------------- Yes No ---------------------------

When I click Yes, I get the following message:

--------------------------- Edit Site Binding ---------------------------

The certificate associated with this binding is also assigned to another site's binding. Editing this binding will cause the HTTPS binding of the other site to be unusable. Do you still want to continue?

--------------------------- Yes No ---------------------------

This message tells me that https://bbb.my-domain.com and https://ccc.my-domain.com will become unusable. And I will have downtime for those at least until I'm done replacing the certificate for those 2 domains too, right?

I was thinking that there must be a smarter way of doing this. Possibly through the command line that replaces the wildcard certificate with a new one for all website at once. I couldn't find any resources online as to how to do that. Any ideas?

Sites related to wildcard and binding:

• http://www.diaryofaninja.com/blog/2010/09/01/binding-multiple-domains-to-a-wildcard-ssl-on-a-single-ip-in-iis-75
• http://www.computer-howto.com/2011/08/running-multiple-ssl-iis-sites-iis7-75/
• https://stackoverflow.com/questions/3895675/how-to-install-wildcard-ssl-cert-on-iis-7-5
• http://blogs.msdn.com/b/asiatech/archive/2010/12/27/setting-up-a-wildcard-certificate-in-iis-7-how-to-avoid-those-certificate-mismatch-errors.aspx

Sites related to binding certificates from the command line:

• IIS7 add certificate to site from command line
• https://stackoverflow.com/questions/591597/how-to-assign-a-ssl-certificate-to-iis7-site-from-command-prompt