How to change Certificate on Windows Remote Management

Learn how to manually replace the WinRM HTTPS listener certificate, update its thumbprint, verify port 5986, and avoid breaking PowerShell remoting.

WinRM over HTTPS normally listens on TCP 5986. Its listener stores the certificate thumbprint and hostname independently from the certificate store, so importing a new PFX does not update PowerShell remoting.

Before you begin

Use an elevated local session or retain HTTP/console access. The replacement must be in LocalMachine\My, have a private key, Server Authentication EKU, and a CN or SAN that matches the listener hostname.

Step-by-step certificate replacement

Export the current listener definition:

winrm enumerate winrm/config/listener
Get-ChildItem WSMan:\localhost\Listener

Import the PFX and record its thumbprint. Ensure Network Service can read its private key where required.

Update an existing HTTPS listener or recreate only that listener:

$selector = @{Address="*";Transport="HTTPS"}
$values = @{Hostname="server.example.com";CertificateThumbprint="<thumbprint>";Port="5986"}
Set-WSManInstance -ResourceURI winrm/config/Listener -SelectorSet $selector -ValueSet $values

If no HTTPS listener exists, New-WSManInstance with the same selector/value sets creates one. Preserve non-default address, URL prefix, and port settings.

Confirm the Windows Firewall still permits the selected port. A service restart is generally unnecessary after the listener is updated.

Verify the new certificate

winrm enumerate winrm/config/listener
Test-WSMan -ComputerName server.example.com -UseSSL -Port 5986
Enter-PSSession -ComputerName server.example.com -UseSSL -Port 5986

Verify from a remote client that trusts the chain, not only locally.

Rollback

Restore the old CertificateThumbprint with the same selector. Use console access if remote management is already unavailable.

Common problems

The listener hostname is absent from the certificate SAN.
The certificate is self-signed, expired, lacks Server Authentication, or is in the wrong store.
The listener was deleted before a recovery path was tested.
TCP 5986 or a custom port is blocked.

Automating certificate replacement with aethercert

The aethercert WinRM target imports the certificate and replaces the local HTTPS listener using the configured hostname and port.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.