Confirm the certificate's validity dates, required DNS names, Server Authentication purpose and trusted issuing chain. Review it in the appropriate Local Computer certificate store or the site's configured certificate-management system. A certificate file without its private key cannot serve as the server's HTTPS identity.

Record the site's current IP, port, hostname and certificate selection. If another service or site already uses the same address and port, plan the binding carefully. Keep the prior working configuration available during the change.

1. Open IIS Manager, expand Sites and select the correct website.
2. Choose Bindings. Add a new binding, or edit the intended existing HTTPS binding when replacing its certificate.
3. Set the type to https and select the required IP address and port, commonly 443.
4. Enter the intended hostname. When using name-based HTTPS on a shared address, configure Server Name Indication for that design and check the clients that must connect.
5. Select the matching certificate from SSL certificate. Inspect its details if friendly names are similar.
6. Save the binding and check that the site remains started. Verify that the necessary firewall path is available.
7. Open the exact HTTPS hostname from a separate client and inspect the certificate actually presented. Test every advertised hostname, including any separate www address.

Check redirects, generated URLs, images, forms and application callbacks. Adding an HTTPS binding does not automatically redirect HTTP requests or correct mixed-content references. Apply those changes through the relevant application or web-server workflow after HTTPS itself passes.

On the Windows IIS server, use elevated PowerShell with the WebAdministration module available. These commands read HTTPS bindings and installed machine certificates. They do not bind, replace, export or delete a certificate.

Import-Module WebAdministration
Get-WebBinding -Protocol https |
  Select-Object bindingInformation, certificateHash, certificateStoreName, sslFlags
Get-ChildItem Cert:\LocalMachine\My |
  Select-Object Subject, Thumbprint, NotAfter, HasPrivateKey

Read the result: Match the site hostname and port with its certificate thumbprint and store. A certificate can exist in the machine store without being assigned to the website. HasPrivateKey helps identify whether the matching private key is available locally, but does not prove the service can access it.

Record the old binding before selecting the replacement in IIS or Plesk. Check SNI and hostname coverage when multiple sites share an address. After the reviewed replacement, test the public endpoint and certificate chain instead of relying only on the local store listing.

• Creating an IIS website with the correct bindings
• Replacing an expiring Windows Server certificate without breaking bindings
• Enabling and using IIS request logs
• Diagnosing Windows Server DNS client resolution

• Microsoft: set up HTTPS on IIS
• Microsoft: IIS HTTPS binding and SNI settings
• Microsoft: IIS website bindings

• Microsoft: AppCmd IIS administration