Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I installed a new SSL certificate into IIS7, removed the old certificate and setup the bindings for the new certificate - so https is now bound to the new certificate only.

I restarted IIS7 (and the Windows 2008 Server itself) and checked the certificate using the commands:

netsh http show sslcert

This showed the new certificate only, as I expected

certutil -store MY

This also only showed the new certificate and not the old one, as I expected

I also opened mmc and checked the certificates there and I only see the new one and not the old one.

I'm also using an account with Administrator privileges.

However - when I open a browser (from any computer) and go to the https site it is still using the old certificate. Even when I remove the old certificate from the browser it still gets sent the old one and not the new one.

Can anyone help me work out where I'm going wrong? How can I exorcize the old phantom certificate?

Many Thanks!

share|improve this question

Check the certificate that is bound to the site in IIS. You can right-click on the site and choose edit bindings. In there, you should see a binding for port 443 that is associated with an SSL cert. That may still be pointing at the old one.

share|improve this answer
I checked and the certificate in the bindings for port 443 is the new certificate, not the old one. Thanks for your suggestion. – joechip Oct 11 '11 at 16:17
Weird, I've never had this happen. Although I never remove the old certificates. How are you sure you're still getting the old cert? Is it showing that it's expired? – Tatas Oct 11 '11 at 17:25
Yes, in the browser you can check the certificate's details (expiration date, etc) and its the old one that IIS7 is serving. – joechip Oct 11 '11 at 17:27
I have seen this with - Chrome. Chrome caching the old certificate and showing that to the user. – TomTom Jun 17 '14 at 15:10

I just worked it out. The server was actually sitting behind an ISA server so we also had to install the new SSL certificate to the ISA server.

share|improve this answer

I had the same issue and checked the bindings also. I had 2 apps installed in IIS, one was using the new certificate, one using the old.

To fix, I had to remove the certificate from the server completely (then possibly a reboot).

From IIS Manager -> (IIS tree root) -> Server Certificates icon, select the old certificate and click Remove in the Actions pane.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.