Windows Server / Services, IIS & Secure Operations
Check a server certificate's identity and validity before replacing it
A TLS outage can involve an expired certificate, missing private key or binding to the wrong certificate. Inspect the intended certificate store.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
Get-ChildItem Cert:\LocalMachine\My | Select-Object Subject, Thumbprint, NotAfter, HasPrivateKeyRead the result
This PowerShell query lists personal-store certificate metadata on the local machine. It does not identify which certificate a remote endpoint actually presents.
Resolve and verify
Compare the endpoint's certificate and binding with the approved hostname, chain and renewal record. Install and bind the correct verified replacement through the certificate process.
Before changing production
Do not export private keys into tickets or delete old certificates before checking other service bindings.