This procedure applies to certificates you administer on a self-managed Windows Server. Identify the certificate owner, issuing authority, renewal method and every service using it. IIS, SQL Server, Remote Desktop and other Windows services have different binding requirements. Keep console or another working administration route available when changing a management-service certificate.

1. Inventory the current usage. Record the expiring certificate thumbprint, covered names, expiry date and certificate store. List each IIS HTTPS binding or other service configuration that references it. Include reverse proxies and load balancers: the public certificate may terminate somewhere other than this Windows server.
2. Obtain and check the replacement. Complete the authority-approved renewal or issuance process with the correct DNS names. Verify validity dates, Server Authentication purpose, trust chain and association with the required private key. A downloaded public certificate by itself is not a replacement for a missing private key.
3. Install in the correct location. Use Certificates for the Local Computer or the service-specific supported procedure. Import the certificate and required intermediate certificates into their appropriate stores. If using a PFX, protect its password and restrict access to the file. Apply private-key permissions only to the service identities that need them.
4. Update each binding deliberately. For a normal IIS site, open IIS Manager, select the website, open Bindings, edit the intended HTTPS entry and select the replacement certificate. Preserve its hostname, IP, port and SNI choices. Sites using a centralized certificate store or an automated renewal tool require that system's documented binding workflow instead.
5. Handle other services separately. A successful IIS change does not update SQL Server or Remote Desktop automatically. Follow the product-specific certificate procedure and restart only the services that require it within the maintenance window. Record every changed binding and its previous value.
6. Verify from outside the server. Connect to every affected hostname with a validating client. Inspect the presented certificate, new expiry date, chain and expected names. Test representative applications and management access. A successful local certificate import or an open existing session does not prove new clients receive the replacement.

In PowerShell on the Windows Server, inspect the machine's personal certificate store and select certificates expiring within 30 days. This reads public certificate metadata. It does not export private keys or remove old certificates.

Get-ChildItem Cert:\LocalMachine\My |
  Where-Object { $_.NotAfter -lt (Get-Date).AddDays(30) } |
  Select-Object Subject, Thumbprint, NotAfter, HasPrivateKey

Read the result: The list includes already expired certificates as well as those nearing expiry. Match each thumbprint to the services that actually use it. A replacement already present in the store does not prove that IIS, RDP, SQL Server or another service has switched to it.

Keep the old certificate until the new bindings and dependent services are verified and your retention policy allows removal. Inspect other documented certificate stores if your service uses them. Test the service endpoint after replacement because the public chain and hostname matter as much as the local expiry date.

The HTTPS binding may still reference the old certificate, another front-end server may terminate TLS, or a separate hostname may use a different binding. Compare the certificate actually presented by the public endpoint with the new thumbprint and inspect the full request path. Do not delete certificates at random to force selection.

Retain the previous still-valid certificate during the agreed verification period so a failed binding change can be reversed. Remove it only after confirming no service still depends on it, and follow your key-retention policy. Record the next expiry and check that any automated renewal also updates bindings and verifies the public endpoint.

• Binding an HTTPS certificate to an IIS website
• Configuring encrypted SQL Server client connections
• Verifying Windows Server time synchronization
• Applying Windows Server updates with a maintenance plan

• IIS binding reference
• Set up TLS on IIS
• Configure IIS intermediate certificates
• Certificate private-key association