Managing certificates from PowerShell: the Cert: drive, PFX import/export, and binding one to IIS

Goal

Inspect certificates in the local machine store, move a certificate with its private key between servers, and bind a certificate to an IIS site's HTTPS binding, checking the result independently of IIS Manager.

Prerequisites

Local administrator rights (the LocalMachine store's private keys require it); the PKI module (built in) for PFX cmdlets; the WebAdministration module and the IIS role for the binding step.

Steps

1. Browse certificates as if they were a filesystem: Get-ChildItem Cert:\LocalMachine\My | Select-Object Subject, Thumbprint, NotAfter. The Cert: provider exposes the certificate stores this way, per PowerShell's own certificate-provider documentation.
2. Filter for certificates expiring soon, a routine an agent can schedule: Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.NotAfter -lt (Get-Date).AddDays(30) } | Select-Object Subject, NotAfter.
3. Export a certificate with its private key for moving to another server: Export-PfxCertificate -Cert Cert:\LocalMachine\My\<thumbprint> -FilePath cert.pfx -Password (ConvertTo-SecureString -String "P@ss1" -Force -AsPlainText). This works only if the private key was marked exportable; the literal password is for illustration — take it from a secret store in real runs.
4. Import it on the target: Import-PfxCertificate -FilePath cert.pfx -CertStoreLocation Cert:\LocalMachine\My -Password (ConvertTo-SecureString -String "P@ss1" -Force -AsPlainText); add -Exportable only if the key must be movable again. Delete the exported .pfx file afterward — it is a portable copy of the private key.
5. For testing only, generate a certificate that is not chained to any trusted root: New-SelfSignedCertificate -DnsName "test.contoso.local" -CertStoreLocation Cert:\LocalMachine\My; never use a self-signed certificate for a production-facing endpoint.
6. Bind a certificate to an IIS site over HTTPS: New-WebBinding -Name "Default Web Site" -Protocol https -Port 443 -IPAddress "*" -HostHeader "www.contoso.com" -SslFlags 1 (-SslFlags 1 enables Server Name Indication so more than one HTTPS site can share port 443 on distinct hostnames; SNI needs a host header), then attach the certificate: (Get-WebBinding -Name "Default Web Site" -Protocol https -HostHeader "www.contoso.com").AddSslCertificate("<thumbprint>", "My").
7. Verify the binding independently of IIS Manager: netsh http show sslcert hostnameport=www.contoso.com:443 for an SNI binding, or netsh http show sslcert ipport=0.0.0.0:443 for a non-SNI one; both report the bound certificate hash directly from the HTTP.sys configuration.

Expected result

The expiry filter lists only soon-to-expire certificates; netsh http show sslcert shows the expected certificate hash bound to the expected IP:port.

Limits and test basis

about_Certificate_Provider, Import-PfxCertificate, Export-PfxCertificate, New-SelfSignedCertificate, New-WebBinding, and netsh http are all documented. A certificate's private key file permissions matter as much as the certificate itself — check who can read an imported key (certlm.msc, "Manage Private Keys") and grant only the service accounts that need it. To undo a binding, remove it with Remove-WebBinding (and its HTTP.sys certificate entry with netsh http delete sslcert); to undo an import, remove the certificate from the store with Remove-Item Cert:\LocalMachine\My\<thumbprint> -DeleteKey so the private key goes too. No reboot or iisreset is required; HTTP.sys uses a changed certificate binding for new TLS connections.