Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working on a system that calls a webservice from a client application. The SSL certificate expired on the server (Windows Server 2008 with IIS) that hosts the webservice. A new SSL certificate was issued to the same entity. Everything is the same except for the new expiration date and a new friendly name. The client now raises a certificate error saying it is expired. The client sees the old certificate but not the new one. How can the SSL certificate be fixed so that the client can call the webservice again? Does this have something to do with a different friendly name? Thanks.

share|improve this question
up vote 1 down vote accepted

Is the site/service correctly bound to the new certificate? From your description it would appear that the client is still being presented with the old certificate.

Can you test on the server itself to confirm that the certificate is correctly bound (e.g Use your preferred browser on the server itself to connect to the site and confirm that the certificate is correctly presented.) If it reports the old expired certificate then your binding would appear to be incorrect and you need to confirm that you have replaced the certificate.

If the server passes this first check:

Is the old certificate in the certificate store on the web server? If so, remove the certificate from the certificate store then attempt to connect again - I've seen behaviour before where an old certificate was somehow getting in the way (usually on Server 2003 where the certificate hadn't been bound to a service account via the winhttpcertcfg utility)

If the server didn't pass this first check (old certificate is still presented):

Confirm you have the certificate installed correctly:

1: Open the Start menu and select Run then MMC. 2: Go up to the File menu and select Add / Remove Snap-in. Select Certificates from the list and press the Add button. 3: Select Computer Account from the list. Press the Next button and press Next button again. Then press the OK button. Certificates (Local Computer) will appear in the Selected snap-ins Window. Press the OK button. 4: From the drop down list, double click on Certificates (Local Computer), then go down a directory level to Personal and lastly, Certificates.

Check that your new certificate is present, if not, import the certificate (or whatever method you employ (renewal, autoenroll etc)

Assuming your new certificate is present:

1: Launch Internet Information Services (IIS) Manager from Administrative Tools 2: Highlight target website on the Left hand column (the name will be different). Then click Bindings on the Right hand column

Internet Information Server - Bindings

3: Select https then click Edit . This will prompt the certificate assigned to this Website Instance.

IIS - Site Bindings

4: Select the certificate you wish to assign from the SSL Certificate drop-down list, and click View to confirm the certificate detail to verify that you are binding the correct certificate.

IIS Certificate Selection

After confirming that it is the correct certificate, click OK. It will now bind the certificate to the site.

Test locally again to verify that the server is presenting the correct certificate.

Proceed to your application testing.

share|improve this answer
I tested on the server itself and the old certificate appears. How do I bind to the correct certificate? – Tarzan Jan 16 '13 at 22:51
I've just updated the answer to include process on binding the certificate to a web site. – Enigman Jan 17 '13 at 2:37
It took me awhile to implement the fix and verify that it worked because of change control policies. It works beautifully. Thanks! – Tarzan Jan 22 '13 at 18:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.