# Identify IIS Server Certificates NOT bound

**URL:** <https://forums.powershell.org/t/identify-iis-server-certificates-not-bound/16192>\
**Category:** PowerShell Help\
**Created:** [April 6, 2021, 5:47pm UTC](https://forums.powershell.org/t/identify-iis-server-certificates-not-bound/16192 "2021-04-06T17:47:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![9thchevron](https://avatars.discourse-cdn.com/v4/letter/9/c5a1d2/32.png) [@9thchevron](https://forums.powershell.org/u/9thchevron)\
**Post date:** [April 6, 2021, 5:47pm UTC](https://forums.powershell.org/t/identify-iis-server-certificates-not-bound/16192/1 "2021-04-06T17:47:24Z")

</div>

I’m looking for a method to identify SSL Certificates installed and visible in IIS Home \> Server Certificates but not currently configured for bindings. I can see this in the IIS Manager GUI, but looking to capture the IIS only certificates in powershell?

---

<div class="post-metadata">

**Author:** ![matt-bloomfield](https://avatars.discourse-cdn.com/v4/letter/m/dec6dc/32.png) [@matt-bloomfield](https://forums.powershell.org/u/matt-bloomfield)\
**Post date:** [April 6, 2021, 9:02pm UTC](https://forums.powershell.org/t/identify-iis-server-certificates-not-bound/16192/2 "2021-04-06T21:02:35Z")

</div>

The certificates in IIS Home \> Server Certificates are the certificates in `Cert:\LocalMachine\My` and the bindings can be found in `IIS:\SSLBindings`.

Knowing that, you can just compare the thumbprints:

```auto
$boundCertThumbprints = Get-ChildItem IIS:\SSLBindings\ | Select-Object -ExpandProperty Thumbprint
Get-ChildItem Cert:\LocalMachine\My | Where-Object {$_.Thumbprint -notin $boundCertThumbprints}

```

---

<div class="post-metadata">

**Author:** ![9thchevron](https://avatars.discourse-cdn.com/v4/letter/9/c5a1d2/32.png) [@9thchevron](https://forums.powershell.org/u/9thchevron)\
**Post date:** [April 7, 2021, 2:46pm UTC](https://forums.powershell.org/t/identify-iis-server-certificates-not-bound/16192/3 "2021-04-07T14:46:55Z")

</div>

Thank you for the explanation, this was very helpful and what I was looking for.

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:26pm UTC](https://forums.powershell.org/t/identify-iis-server-certificates-not-bound/16192/4 "2024-05-16T20:26:51Z")

</div>