I’m looking for a method to identify SSL Certificates installed and visible in IIS Home > Server Certificates but not currently configured for bindings. I can see this in the IIS Manager GUI, but looking to capture the IIS only certificates in powershell?
The certificates in IIS Home > Server Certificates are the certificates in Cert:\LocalMachine\My and the bindings can be found in IIS:\SSLBindings.
Knowing that, you can just compare the thumbprints:
$boundCertThumbprints = Get-ChildItem IIS:\SSLBindings\ | Select-Object -ExpandProperty Thumbprint
Get-ChildItem Cert:\LocalMachine\My | Where-Object {$_.Thumbprint -notin $boundCertThumbprints}
Thank you for the explanation, this was very helpful and what I was looking for.