How to Export and Import SSL Certificates on Windows Servers.

[Exporting] and [importing][SSL Certificates] are a necessary evil for all [Network Administrators].
In this Article, we will copy files from one server to all others within our Network.

There will be two codes for each command.

copy and paste into PowerShell
Copy and paste into a file, name it with a .ps1 extension.

Export SSL Certificate

If you are using a different machine, you will need the first line; otherwise, omit it.
This will connect you to the server from which you will export the certificate.

[PowerShell - Export SSL Cert]

CFFCS | CarrzSynEdit: | PS (PowerShell)

Enter-PSSession -ComputerName webcore1
$thumprint = (Get-ChildItem -Path Cert:\LocalMachine\WebHosting | Where-Object {$_.Subject -match "CN=autodiscover.DOMAINNAME.COM"}).Thumbprint
$pwd = ConvertTo-SecureString -String "YOURPASSWORDGOESHERE" -Force -AsPlainText
Get-ChildItem -Path Cert:\LocalMachine\WebHosting\$thumprint | Export-PfxCertificate -FilePath G:\SSL\DOMAINNAME.pfx -Password $pwd

[PS1] Version

[PowerShell - Exported SSL Cert on Remote Server]

CFFCS | CarrzSynEdit: | PS (PowerShell)

try
{
Enter-PSSession -ComputerName webcore1
$thumprint = (Get-ChildItem -Path Cert:\LocalMachine\WebHosting | Where-Object {$_.Subject -match "CN=autodiscover.DOMAINNAME.COM"}).Thumbprint
$pwd = ConvertTo-SecureString -String "YOURPASSWORDGOESHERE" -Force -AsPlainText
Get-ChildItem -Path Cert:\LocalMachine\WebHosting\$thumprint | Export-PfxCertificate -FilePath G:\SSL\DOMAINNAME.pfx -Password $pwd
Write-Host "Exported Successfully!"
} catch {
	write-error "Something went wrong:  $($_.Exception.Message)"
return	
}

Copy from one Server to another Server

If you are like me and have many machines to apply this Cert to, do the following.
Run the following command (I always give my certs the date they were made as their name; this helps when deleting the old ones on each machine).

[PowerShell - Copy CERT pfx files for other Web Servers in the network.]

CFFCS | CarrzSynEdit: | PS (PowerShell)

Copy-Item -Path 'G:\SSL\YOURDOMAIN-02-14-2026.pfx' -Destination \\Webcore2\g\SSL\YOURDOMAIN-02-14-2026.pfx
Copy-Item -Path 'G:\SSL\YOURDOMAIN-02-14-2026.pfx' -Destination \\Webcore3\g\SSL\YOURDOMAIN-02-14-2026.pfx
Copy-Item -Path 'G:\SSL\YOURDOMAIN-02-14-2026.pfx' -Destination \\Webcore4\g\SSL\YOURDOMAIN-02-14-2026.pfx

[PS1] (Each within their own, this makes it easier to catch any issues during the copying process.)

[PowerShell - Copy from Server1 to Server 2]

CFFCS | CarrzSynEdit: | PS (PowerShell)

try
{
Copy-Item -Path 'G:\SSL\YOURDOMAIN-02-14-2026.pfx' -Destination \\Webcore2\g\SSL\YOURDOMAIN-02-14-2026.pfx
Write-Host "Exported Successfully!"
} catch {
	write-error "Something went wrong:  $($_.Exception.Message)"
return	
}

Import SSL Certificate

Next, we will [import] the new [SSL Certificate] into each Server to which we copied the files.

[PowerShell - Import Cert into Remote Server 2]

CFFCS | CarrzSynEdit: | PS (PowerShell)

Enter-PSSession -ComputerName WebCore2
$pwd = ConvertTo-SecureString -String "YOURPASSWORDGOESHERE" -Force -AsPlainText
Import-PfxCertificate -FilePath G:\SSL\DOMAINNAME-02-14-2026.pfx Cert:\LocalMachine\WebHosting -Password $pwd
Exit-PSSession

Enter-PSSession -ComputerName WebCore3
$pwd = ConvertTo-SecureString -String "YOURPASSWORDGOESHERE" -Force -AsPlainText
Import-PfxCertificate -FilePath G:\SSL\DOMAINNAME-02-14-2026.pfx Cert:\LocalMachine\WebHosting -Password $pwd
Exit-PSSession

[PS1] (Each within their own, this makes it easier to catch any issues during the copying process.)

[PowerShell - Import CERT into Remote Server PS1 file.]

CFFCS | CarrzSynEdit: | PS (PowerShell)

try
{
Enter-PSSession -ComputerName WebCore2
$pwd = ConvertTo-SecureString -String "YOURPASSWORDGOESHERE" -Force -AsPlainText
Import-PfxCertificate -FilePath G:\SSL\DOMAINNAME-02-14-2026.pfx Cert:\LocalMachine\WebHosting -Password $pwd
Exit-PSSession
Write-Host "Imported Successfully!"
} catch {
	write-error "Something went wrong:  $($_.Exception.Message)"
return	
}

Set IIS to use new SSL Certificate

Next, open [IIS]
Select each Domain
Go into [Bindings]
Set each [domain] and [sub-domain] to the new Cert.