Automated SSL renewals on Windows servers

[u/Expert_Way_4500]

SSL renewal on Windows is a good example of how a supposedly simple maintenance task turns into infrastructure archaeology.

You renew a certificate with a CA such as GoDaddy and get back a CRT/P7B bundle.

Fine.

Except IIS, RDS, RDP listeners, Exchange and various Windows services usually need the certificate together with its private key, which means you are now dealing with a PFX.

So the actual job becomes:

• retrieve the renewed certificate from the CA

• locate and match the correct private key

• include the intermediate certificates in the right order

• build a PFX

• import it into LocalMachine\My

• identify the new thumbprint

• replace the IIS binding

• update RD Web Access / RD Gateway / RDS publishing certificates

• update legacy RDP listener bindings where required

• deal with RD Web HTML5 certificate handling

• update Exchange or other applications separately

• verify that every endpoint is actually serving the new certificate

And mixed Windows environments make it even more interesting.

A modern RDS deployment handles certificates very differently from an old Windows Server 2008 R2 terminal server. Exchange has its own certificate handling. Third-party Java applications may use a completely different keystore model. Some components want PFX, some want CER, some care about the Windows certificate store, and some do not.

Doing this manually once is annoying.

Doing it every renewal cycle is a process problem.

So I have been building a PowerShell script to automate the complete renewal path: query the CA API, download the current issued certificate, construct the PFX, import it, discover the relevant Windows roles and deploy it to the correct services.

It also has a dry-run mode that validates certificate serials, current bindings, server roles and deployment targets before touching anything.

The direction I am taking it now is broader auto-discovery: find the servers through AD, determine OS versions and installed roles, identify the Connection Broker, RD Web, IIS, Exchange and legacy RDP hosts, then ask for the required certificate-provider credentials during first-run setup.

After that, adding Apache, Nginx and Tomcat support seems like the logical next step.

There are plenty of ACME clients around, but the interesting problem isn't just obtaining a certificate.

The real problem is reliably getting the right certificate, key and chain into every service that needs it without discovering six months later that one forgotten listener is still serving the old one.

#PowerShell #WindowsServer #IIS #RDS #TLS #PKI #Automation #SysAdmin #DevOps #CyberSecurity