How do I set up the IIS script on a Windows server?

The IIS script gets a certificate, binds it to your site in IIS and renews it before it expires. It's plain PowerShell, so there's nothing to install.

In Passbeam open the client, then Server certificates, and click Add IIS server. Type the names the certificate should cover, the IIS site to bind it to (as it's named in IIS Manager) and how long it should last.

Enlarge

Click Make the command and copy it. It works once, within an hour.

Enlarge

On the server, open PowerShell as Administrator and paste it in. You should see something like this:

PS C:\> (the command from Passbeam)Certificate installed for intranet.riverside.local, web01.riverside.local, valid until 2027-10-16T09:12:40.000Z.Added an HTTPS binding on 443 for intranet.riverside.local to "Staff Intranet"."Staff Intranet" *:443:intranet.riverside.local now uses the new certificate.Renewal check passed: this server can renew its own certificate.Daily task "Passbeam server certificate (intranet.riverside.local)" installed. Nothing else to do on this server.

That's it. A daily task renews the certificate when a third of its life is left, moves the IIS bindings over and removes the old one. If anything goes wrong it's in C:\ProgramData\Passbeam\passbeam-iis.log.

Every HTTPS binding on the site moves to the new certificate. If the site doesn't have one yet, the script adds one on port 443 for the first name.

To renew straight away, for example to check it works, run powershell -NoProfile -ExecutionPolicy Bypass -File C:\ProgramData\Passbeam\passbeam-iis.ps1 -Name <first name> -Force.

If the server isn't managed by Intune it also needs to trust the client's Passbeam root. See Do servers and PCs outside Intune trust these certificates?