IIS, SNI, and Multi-SAN Certificates: Where AD CS Auto-Enrollment Runs Out of Runway
IIS CERTIFICATE RENEWAL AT A GLANCE
How does IIS certificate renewal work with Microsoft AD CS?
AD CS provides certificate enrollment and renewal capabilities for Windows users and computers.
In a domain environment, certificate templates and enrollment policies can automate much of this process. Microsoft also provides Certificate Enrollment Web Services for policy-based enrollment and renewal scenarios.
This works well when the lifecycle being managed is primarily:
Windows system → certificate store → AD CS
IIS introduces another operational layer:
AD CS → Windows certificate store → IIS HTTPS configuration → website
The certificate being present on the server is therefore only part of the process.
The correct certificate must also be available to and used by the intended HTTPS endpoint.
Why is an IIS certificate different from a machine certificate?
A machine certificate primarily needs to be available to the Windows system or service that consumes it.
An IIS HTTPS certificate is also associated with the web server's binding configuration.
Microsoft documents IIS website bindings as containing information such as:
- protocol
- IP address
- port
- hostname
For HTTPS, additional SSL configuration determines how the certificate is used.
This creates an operational relationship between:
Certificate → hostname → IIS binding → website
All of those elements need to remain aligned throughout the certificate lifecycle.
What is SNI and how does it affect IIS certificate renewal?
Server Name Indication (SNI) allows multiple HTTPS sites to operate on the same network address.
The hostname is supplied as part of the TLS handshake, allowing IIS to use hostname information when processing the secure connection. Microsoft specifically describes SNI as useful when hosting multiple secure sites on one network address.
For example:
All three sites can share the same network address while maintaining their own HTTPS configuration.
Operationally, however, the organisation now needs to keep multiple certificates, hostnames, bindings and renewal events correctly aligned.
What is IIS certificate binding drift?
Certificate binding drift occurs when certificate state and the web-server configuration become out of sync.
For example:
- A replacement certificate is issued.
- The certificate becomes available on the server.
- The intended endpoint is still configured to use a previous certificate.
- That previous certificate expires.
- Users begin encountering TLS or browser certificate errors.
This matters because successful certificate issuance does not, by itself, prove that the application is presenting the intended certificate.
Microsoft's IIS SSL documentation shows this distinction at the configuration level: IIS/HTTP.sys SSL configuration references the certificate hash and certificate store associated with the binding. Microsoft Learn
Certificate monitoring therefore needs to answer more than:
“Does this server have a valid certificate?”
It should also answer:
“Which certificate is this endpoint actually presenting?”
Does IIS automatically use a renewed certificate?
The answer depends on how IIS certificate management has been designed.
It would be inaccurate to say that IIS can never automate this process.
Microsoft supports different certificate-management models. For example, IIS supports a Centralized Certificate Store, and SNI can be used together with centralized certificate management. Microsoft documents sslFlags for both SNI and the Centralized Certificate Store.
With the Centralized Certificate Store, IIS can determine the hostname of an incoming request and locate a correspondingly named certificate file. Microsoft describes this as a way to simplify certificate management across large numbers of secure sites.
The broader enterprise challenge is ensuring that whichever architecture is used remains:
automated + monitored + governed + visible
across the entire certificate estate.
How do multi-SAN certificates work with IIS and AD CS?
A multi-SAN certificate contains multiple hostnames in its Subject Alternative Name extension.
For example, one certificate could cover:
portal.example.com
api.example.com
admin.example.com
This can reduce the number of individual certificates an organisation manages.
But it introduces another lifecycle dependency:
The SAN list must remain aligned with the infrastructure actually using the certificate.
If an application is added, removed or renamed, the certificate request and renewal process must continue to reflect the correct hostname set.
Multi-SAN vs individual certificates
There is no universally correct model.
The appropriate approach depends on security policy, infrastructure architecture, certificate volume and the organisation's ability to automate the lifecycle.
What about F5, NGINX, HAProxy and other TLS endpoints?
IIS is only one part of the certificate-management problem.
An enterprise may need certificates for IIS alongside:
F5 load balancers · NGINX · HAProxy · API gateways · Linux servers · Kubernetes · network appliances · cloud workloads
These systems do not necessarily use the same enrollment and deployment mechanisms as Windows systems.
The result can be an environment where one certificate population is handled through Windows enrollment, another through scripts, another through an API, and another through ACME or SCEP.
Each mechanism can work individually.
The operational challenge is managing all of them together.
This is also where you should internally link to:
Teaching AD CS New Tricks: ACME, SCEP, and the DevOps Pipeline
That article addresses the ACME/SCEP side in detail, while this article stays focused on IIS, SNI and web-server certificate lifecycle management.
Where IIS certificate automation commonly breaks down
How does certificate lifecycle management help IIS?
Certificate Lifecycle Management (CLM) addresses a broader problem than certificate issuance.
It provides an operational layer for managing certificates across their lifecycle, including:
Discovery → Inventory → Enrollment → Deployment → Renewal → Monitoring → Governance
The objective is to move from asking:
“Did the CA issue the certificate?”
to:
“Is the correct certificate deployed to the correct service, is it valid, and will the lifecycle continue automatically?”
That distinction becomes increasingly important as certificate environments grow beyond Windows systems.
How does CEMA manage IIS and other certificates?
CEMA Certificate Lifecycle Management provides a central layer for certificate visibility, automation and governance across heterogeneous certificate environments.
Rather than treating IIS certificates, Windows certificates, load-balancer certificates and other endpoints as independent certificate populations, CEMA brings their lifecycle management into a common operational framework.
This helps organisations reduce dependence on disconnected scripts and processes while improving visibility into certificate state, renewal and deployment.
→ EXPLORE CEMA CERTIFICATE LIFECYCLE MANAGEMENT
How does this connect to ACME and DevOps?
IIS illustrates one part of the broader certificate automation challenge.
Kubernetes, Linux and DevOps environments increasingly rely on protocols such as ACME, while network devices may use SCEP.
The architectural question becomes:
How do you automate certificate lifecycles across traditional Windows infrastructure and modern workloads without creating separate management silos?
→ RELATED: Microsoft AD CS and ACME: How to Automate Certificates for Kubernetes, Linux and DevOps
How does certificate lifecycle management support crypto-agility?
Certificate automation also plays a role in crypto-agility.
When cryptographic algorithms, certificate profiles, key sizes or organisational policies need to change, teams need to know:
What certificates exist?
Where are they deployed?
Which services depend on them?
How can they be replaced?
A fragmented certificate estate built around manual processes and disconnected scripts makes large-scale cryptographic change more difficult.
A managed certificate lifecycle makes those changes more repeatable and visible.
→ RELATED: Cryptographic Discovery: How to Build a PQC Cryptographic Inventory
→ RELATED: How to Build a PQC Migration Roadmap Your Board Can Approve
THE KEY TAKEAWAY
Microsoft AD CS can automate important parts of certificate enrollment and renewal in Windows environments.
IIS adds another operational layer because certificates are used as part of HTTPS website configurations involving hostnames, ports and bindings. SNI allows IIS to support multiple secure sites on the same network address, while the Centralized Certificate Store provides another model for managing certificates at scale. Microsoft Learn
Beyond IIS, organisations may also need to manage certificates across load balancers, Linux systems, Kubernetes, network devices and cloud infrastructure.
The important question is therefore not simply:
“Can AD CS renew my IIS certificate?”
It is:
“Can we automate and monitor the complete certificate lifecycle across every service that uses certificates?”
That is the problem Certificate Lifecycle Management is designed to address.
-
FREQUENTLY ASKED QUESTIONS ABOUT IIS CERTIFICATE RENEWAL
Can Microsoft AD CS automatically renew IIS certificates?
AD CS can automate certificate enrollment and renewal in supported Windows scenarios. For IIS, organisations also need to consider how the renewed certificate is made available to and used by the correct HTTPS endpoint.
Does IIS automatically use a renewed certificate?
It depends on the certificate-management architecture. IIS supports multiple certificate configuration models, including traditional HTTPS bindings, SNI and the Centralized Certificate Store. Certificate renewal should therefore be considered as one component of the complete IIS certificate lifecycle. Microsoft Learn
What is SNI in IIS?
Server Name Indication allows hostname information to be exchanged during the TLS handshake. IIS can use SNI to support multiple HTTPS sites on the same network address. Microsoft Learn
Can IIS use multiple SSL certificates on one IP address?
Yes. IIS supports SNI, which allows hostname-based HTTPS configurations to share a network address. Microsoft Learn
What is IIS certificate binding drift?
Certificate/binding drift describes a situation where the certificate available to the server and the certificate configuration of the intended HTTPS endpoint are no longer aligned.
Can AD CS issue multi-SAN certificates?
Yes. AD CS can issue certificates containing multiple Subject Alternative Names when certificate templates, requests and CA policy are configured appropriately.
What is IIS Centralized Certificate Store?
The IIS Centralized Certificate Store provides a mechanism for storing certificate files centrally. IIS can use hostname information to locate the corresponding certificate, helping simplify certificate management across large numbers of sites. Microsoft Learn
How do you automate IIS SSL certificate renewal?
End-to-end automation requires more than certificate issuance. The process should account for enrollment, renewal, deployment, the appropriate IIS configuration and monitoring of the certificate actually used by the endpoint.
How can Certificate Lifecycle Management help with IIS?
Certificate Lifecycle Management can centralise certificate discovery, inventory, enrollment, renewal, deployment, monitoring and governance across IIS and other infrastructure.
