I am trying to configure winrm https listener on a windows machine. Earlier i had followed WinRm https listener configuration

The above solution worked for me.

But now i have deleted the listener and want to configure the winrm again using winrm quickconfig -transport:https but i am unable to do it as its throwing error


Message = Cannot create a WinRM listener on HTTPS because this machine does not have an appropriate certificate. To be used for SSL, a certificate must have a CN matching the hostname, be appropriate for Server Authentication, and not be expired, revoked, or self- signed.

Even deletion of the https listener i am unable to do quick config .i feel there is a need to remove the thumbprint from some place but not sure from where all.

I have gone through one of the links where Jared stated that we need to manually delete the thumbprint: Automatically reconfigure WinRM HTTPS listener

  • I experienced the same error; tried everything mentioned in the below answer and in related articles. The solution for me was to create a new certificate instead of using one of the existing certificates on my server. The existing certificates were all server and client authentication, so I only used server auth in my new cert. – SturdyErde Jan 20 '17 at 20:23

I've made recently HTTPS + WINRM and got exactly the same problems.

The solution is - before invoking command

winrm quickconfig -transport:https

you must do some prerequisite job. to be more specific you must install on the server certificate.

you can look how to do that here - http://blogs.technet.com/b/jhoward/archive/2005/02/02/365323.aspx

to make the long story short:

1 create CA ROOT certificate

cmd> makecert -pe -n "CN=Test And Dev Root Authority" -ss my -sr LocalMachine -a sha1 -sky signature -r "Test And Dev Root Authority.cer"

export it with private key from certificates mmc from host where you invoke makecert and install on the server and client host to certificates.mmc -local machine - Trusted root authorities

2 create ssl certificate

cmd> makecert -pe -n "CN=" -ss my -sr LocalMachine -a sha1 -sky exchange -eku -in "Test And Dev Root Authority" -is MY -ir LocalMachine -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12

where CN= - must be IP of the server

export the certificate with private key from certificate mmc and import to the server to certificates.mmc - localmachine - personal


winrm quickconfig -transport:https

i hope my spent a coiuple of days trying to figure out how it works will save your couple of days

  • Is creating the CA ROOT cert necessary? Is a self-signed cert not enough? – jschmitter Apr 15 '20 at 20:24
  • If you cannot run 'makecert' because you don't have Visual Studio installed on the target machine, please use the powershell command 'New-SelfSignedCertificate' instead (visualstudiogeeks.com/devops/…) – Luis Gouveia Apr 28 '20 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.