Automation of Web Application Creation in Managed Environments (Part VI: Edit bindings for IPs and Certificates on the IIS Site)

For the sixth part of this series we have a special one. This might be the least stable one and you may need to change something to make it work. It is also one of these things when you finally get it done you click F5 and then it’s like “wow, sweet!”.

param (
    [string] $sitename,
    [string] $url,
    [string] $ip

import-module webadministration;

Function GetCertificate {
    param (
        [string] $url

    $url = $url.ToUpper();
    $url = $url.Replace("DOMAIN.SOMEEXTENSION", "domain.someextension");

    $cert = Get-ChildItem cert:\localmachine\my | ? { $_.Subject.Contains("CN=$url")}


Function BindCertificate {
    param (
        [System.Security.Cryptography.X509Certificates.X509Certificate] $cert,
        [string] $ip
    $certObj = Get-Item $cert.PSPath; 

    $item = get-Item IIS:SslBindings\${ip}!443;

    if($item -eq $null) {
        New-Item IIS:SslBindings\${ip}!443 -value $certObj;
    } else {
        Set-Item IIS:SslBindings\${ip}!443 -value $certObj;

Function ReplaceWebsiteBinding {
        [string] $sitename,
        [string] $oldBinding,
        [string] $newValue

    $wsbindings = (Get-ItemProperty -Path "IIS:\Sites\$sitename" -Name Bindings);

    for($i=0;$i -lt ($wsbindings.Collection).length;$i++) {
            ($wsbindings.Collection[$i]).bindingInformation = $newValue;
    Set-ItemProperty -Path "IIS:\Sites\$sitename" -Name Bindings -Value $wsbindings

$cert = GetCertificate $url;

if($cert -ne $null) {
    BindCertificate $cert $ip;

ReplaceWebsiteBinding $sitename "*:443:" "${ip}:443:";

So let’s check this script out. We have a sitename, we have an ip and we have the url of the website. We need the ip of course, because we wan’t to set that in the bindings and if you use https you need to anyway (that is if you don’t use a wild card certificate). The script does three things. It retrieves the certificate based on the url (the url needs to be in the subject of the certificate), it binds the certificate on the IP. So once you have the IP and the certificate bound you can replace the websitebindung (which is actually not yet associated with the sitename yet).

So you need to get the site via the sitename which is the path as well in the IIS:\ directory. It expects that you do not have a “real” binding, i.e. the way SharePoint creates it in Part II, plain and simple with “all unassigned:443”. If that’s not the case for you for any reason you need to edit the second of the three parameters. The third parameter represents what you have set in the second step: the correct binding.

So all the function does is iterate over all bindings of the site and edit the one you want to replace (the one given as second parameter). The last step is just replacing the old with the new. That’s it. IIS is set up. Off to the next step…

Continue Reading…Part VII

Back To Part V
Back To Overview



One Response to Automation of Web Application Creation in Managed Environments (Part VI: Edit bindings for IPs and Certificates on the IIS Site)

  1. Lucy says:

    Pretty nice post. I simply stumbled upon your weblog and wished to say that I’ve truly loved browsing your blog posts.
    After all I will be subscribing on your feed and I am hoping you write once more soon!

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: