RymarisCerts IIS recorded installation walkthrough This is a genuine scripted terminal/PowerShell session on an isolated demo server. All displayed operations were executed. No production certificates, passwords, MFA, or private-key contents are included. Lab .test hostnames and explicit-root checks must be replaced with your own hostnames and normal public trust in production. Passwords were supplied privately before recording. On your server enter package passwords locally;never put them into commands,source files,or website configuration. 00:00:00.000 Chapter 1: Confirm IIS and the prepared lab 00:00:08.511 Chapter 2: Back up IIS and select the PFX 00:00:16.565 Chapter 3: Import and check the private key 00:00:24.646 Chapter 4: Select the exact hostname and SNI binding 00:00:36.848 Chapter 5: Verify real HTTPS and the control site 00:00:48.919 Chapter 6: Import renewal and switch the binding 00:01:03.082 Chapter 7: Prove certificate rollback 00:01:15.201 Chapter 8: Restore renewal and finish checks RECORDED COMMANDS AND OUTPUT RymarisCerts | IIS certificate installation CHAPTER 1 | Confirm IIS and the prepared lab Recorded scripted session;all displayed commands execute. Disposable .test certificates are not publicly trusted. The protected-package password was supplied privately. PS> Get-WindowsFeature Web-Server Name Installed ---- --------- Web-Server True PS> Get-Website -Name RymarisCerts-Demo name state physicalPath ---- ----- ------------ RymarisCerts-Demo Started C:\RymarisCertsDemo\IIS RymarisCerts | IIS certificate installation CHAPTER 2 | Back up IIS and select the PFX PS> appcmd add backup RymarisCerts-Video BACKUP object "RymarisCerts-Video-20261113-162319" added PS> Get-Item $packages\initial.pfx Name Length ---- ------ initial.pfx 3614 RymarisCerts | IIS certificate installation CHAPTER 3 | Import and check the private key PS> Import-PfxCertificate -FilePath "$packages\initial.pfx" -CertStoreLocation Cert:\LocalMachine\My -Password $PackagePassword PSParentPath: Microsoft.PowerShell.Security\Certificate::LocalMachine\My Thumbprint Subject ---------- ------- BB2DCC2632A0AF826198A405E13AC3B744F31FF6 CN=iis.rymariscerts.test PS> $initial | Select-Object Subject,NotAfter,HasPrivateKey,Thumbprint Subject NotAfter HasPrivateKey Thumbprint ------- -------- ------------- ---------- CN=iis.rymariscerts.test 12/13/2026 6:16:49 AM True BB2DCC2632A0AF826198A405E13AC3B744F3... RymarisCerts | IIS certificate installation CHAPTER 4 | Select the exact hostname and SNI binding PS> Get-WebBinding -Name $site -Protocol https protocol bindingInformation sslFlags -------- ------------------ -------- https 127.0.0.1:443:iis.rymariscerts.test 1 PS> Set-WebBinding -Name $site -BindingInformation 127.0.0.1:443:iis.rymariscerts.test -PropertyName sslFlags -Value 1 PS> $binding.AddSslCertificate($initial.Thumbprint,"My") RymarisCerts | IIS certificate installation CHAPTER 5 | Verify real HTTPS and the control site PS> Peer | Format-List Subject : CN=iis.rymariscerts.test NotAfterUtc : 2026-12-13 14:16:49Z Thumbprint : BB2DCC2632A0AF826198A405E13AC3B744F31FF6 FingerprintSha256 : 8D8F9A430E073112A944E0C548C16E68100A151EDD99698236DE939873E3BDCD PS> (Invoke-WebRequest http://127.0.0.1/ -UseBasicParsing).StatusCode 200 Peer uses native curl validation against this explicit disposable lab root. Production must pass normal public trust and actual DNS from another device. RymarisCerts | IIS certificate installation CHAPTER 6 | Import renewal and switch the binding PS> Import-PfxCertificate -FilePath "$packages\renewed.pfx" -CertStoreLocation Cert:\LocalMachine\My -Password $PackagePassword PSParentPath: Microsoft.PowerShell.Security\Certificate::LocalMachine\My Thumbprint Subject ---------- ------- F7559681A4CFC486B238EFD652F6C6ACBE64418B CN=iis.rymariscerts.test PS> $renewed | Select-Object Subject,NotAfter,HasPrivateKey,Thumbprint Subject NotAfter HasPrivateKey Thumbprint ------- -------- ------------- ---------- CN=iis.rymariscerts.test 1/12/2027 6:16:49 AM True F7559681A4CFC486B238EFD652F6C6ACBE64418B PS> $binding.AddSslCertificate($renewed.Thumbprint,"My") PS> Peer | Format-List Subject : CN=iis.rymariscerts.test NotAfterUtc : 2027-01-12 14:16:49Z Thumbprint : F7559681A4CFC486B238EFD652F6C6ACBE64418B FingerprintSha256 : 64C633BEBEDB23E6172F6A2E0554BA50D29D67B2ADF72B92F4941E500F1ABDC4 RymarisCerts | IIS certificate installation CHAPTER 7 | Prove certificate rollback PS> $binding.AddSslCertificate($initial.Thumbprint,"My") PS> Peer | Format-List Subject : CN=iis.rymariscerts.test NotAfterUtc : 2026-12-13 14:16:49Z Thumbprint : BB2DCC2632A0AF826198A405E13AC3B744F31FF6 FingerprintSha256 : 8D8F9A430E073112A944E0C548C16E68100A151EDD99698236DE939873E3BDCD Rollback restored the initial certificate. Keep the protected old package until all intended hostnames and external checks pass. RymarisCerts | IIS certificate installation CHAPTER 8 | Restore renewal and finish checks PS> $binding.AddSslCertificate($renewed.Thumbprint,"My") PS> Peer | Format-List Subject : CN=iis.rymariscerts.test NotAfterUtc : 2027-01-12 14:16:49Z Thumbprint : F7559681A4CFC486B238EFD652F6C6ACBE64418B FingerprintSha256 : 64C633BEBEDB23E6172F6A2E0554BA50D29D67B2ADF72B92F4941E500F1ABDC4 PS> (Invoke-WebRequest http://127.0.0.1/ -UseBasicParsing).StatusCode 200 Renewal active;control site returns200. Downloading does not install a renewal. Use your actual site and authorized certificate. Password/MFA were not recorded. LAB HELPER NOTE Peer validates the real HTTPS connection with native Windows curl and the explicit lab root,then reports the peer subject,expiry and thumbprint. It is a demo helper, not a built-in IIS cmdlet. For a public certificate,check normal browser trust and curl https://your-hostname/ from another device. Supply PackagePassword using Read-Host -AsSecureString before importing your protected PFX.