Replace the Windows Admin Center HTTPS certificate deliberately

Source facts

Windows Admin Center requires an HTTPS certificate for its service. Microsoft requires a valid certificate with Server Authentication usage, a private key, and a name matching the gateway FQDN or IP address; its issuer must be trusted by the gateway and clients. The documented subject-name selection method requires a unique certificate subject name in the local-machine Personal certificate store. Microsoft Learn.

Applicability

Identify the gateway address administrators actually use and the certificate-selection method for the installed version. Review the public certificate properties without exporting its private key. A successful certificate import is only one part of this replacement decision.

DSE recommendation

Prepare the replacement against the gateway name, intended client trust, validity period, and private-key requirement. Where selection uses a subject name, inspect the relevant store for ambiguous matches before proceeding. Schedule the change with another management route available. Keep the previous certificate available under approved retention and key-handling rules until the replacement has passed the agreed connection checks.

Verification

Connect from an intended administrator browser using the normal gateway URL. Inspect the certificate actually presented, its name and trust chain, and then open a managed connection. If an error remains, review Windows Admin Center events alongside the browser error and record which certificate was selected.

Official references

Microsoft Learn: Update the certificate used by Windows Admin Center. Source reviewed September 8, 2026.