Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a Windows 2012 server we create websites using C# code. This also applies the https binding w/ SSL.

For some reason whenever a new site is created it sets all sites' SSL cert to "Not Selected" Is there way to prevent this?

enter image description here

Code we use

 //get the server manager instance
            using (ServerManager mgr = new ServerManager())
                SiteCollection sites = mgr.Sites;
                Site site = mgr.Sites[siteName];
                if (site != null)
                    ProcessStartInfo startInfo = new ProcessStartInfo();
                    startInfo.CreateNoWindow = false;
                    startInfo.UseShellExecute = false;
                    startInfo.WorkingDirectory = @"C:\Windows\System32\Inetsrv";
                    startInfo.FileName = "appcmd.exe";
                    startInfo.WindowStyle = ProcessWindowStyle.Hidden;
                    startInfo.Arguments = string.Format("set site /\"{0}\" /+bindings.[protocol='https',bindingInformation='{1}:443:{2}']", siteName, ipAddress, hostHeader);

                    using (Process exeProcess = Process.Start(startInfo))
                        return true;
                    throw new Exception("Site: " + siteName + " does not exist.");
share|improve this question

Assuming that appcmd interacts with IIS8 in exactly the same way as with IIS7 (haven't poked around with it yet), the answer is NO.

SSL termination is handled in the HTTP stack before the request reaches IIS. For that reason, certificate-to-endpoint assignment is handled by the OS, not by IIS. appcmd.exe only updates IIS configuration files, it doesn't interact with OS dependencies like certificate assignment.

When you use appcmd set site you are effectively resetting/overwriting the previous site configuration.

To update certificate-to-endpoint mappings you need to use netsh.exe as outlined in:

netsh http add sslcert ipport= certhash=baf9926b466e8565217b5e6287c97973dcd54874 appid={ab3c58f7-8316-42e3-bc6e-771d4ce4b201}

where baf9926b466e8565217b5e6287c97973dcd54874 is the certificate thumbprint, and is the ip endpoint ( means the same as "Any Unassigned")

UPDATE: If you always use existing endpoints for HTTPS bindings (eg. always "Any Unassigned":443), I believe you could successfully overcome this issue by backing up the following Registry key (including subkeys):


Write it back to the registry after you've run appcmd set site

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.