# Utilizing win\_iis\_webbinding to update IIS certs **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [November 14, 2017, 11:04pm UTC](https://forum.ansible.com/t/utilizing-win-iis-webbinding-to-update-iis-certs/26023 "2017-11-14T23:04:30Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![John\_Martin](https://avatars.discourse-cdn.com/v4/letter/j/4af34b/32.png) [@John\_Martin](https://forum.ansible.com/u/John_Martin)\ **Post date:** [November 14, 2017, 11:04pm UTC](https://forum.ansible.com/t/utilizing-win-iis-webbinding-to-update-iis-certs/26023/1 "2017-11-14T23:04:30Z")
Hello, I’m new to Ansible and have been giving it some attention in my test environment to see how feasible it is to utilize in production… Mainly to provision/configure/manage 30 or so Windows web-servers. I was able to copy and install my cert and bind it to my site with win\_iis\_webbinding; however, testing if I need to update the cert for whatever reason, I upload a new cert, change the certificate\_hash, and nothing happens. The old cert is still in play. It’s my understanding from looking around on other sites that the certificate\_hash isn’t inspected when reviewing pending changes on a playbook play regarding this module, so I’m curious if there’s a way to accomplish updating the cert if the certificate\_hash is different. I attempted to run a play in the playbook to mark the port binding as absent before setting the new thumbprint in the certificate\_hash, but received an error stating that it “Cannot create a file when that file already exists.” Digging deeper I found that if I remove the play below that adds SSL Binding for new site, and only set state of the binding to absent, then the SSL binding is removed. If I try to add the play below in with the new thumbprint, I get the error that the file already exists and the binding reappears with the original cert, not the new updated one. So regardless of what I define the certificate\_hash, the original hash always gets added. Portion of Playbook: #- name: Remove SSL Binding for newSite # win\_iis\_webbinding: # name: newSite # protocol: https # port: 443 # state: absent - name: Add SSL Binding for newSite win\_iis\_webbinding: name: newSite protocol: https port: 443 certificate\_hash: thumbprint (when changed, it gets skipped and never updates on IIS sites) state: present Does anyone know of a way to update the cert on a site? Or would it just be best to explore options outside of the module to accomplish this task, such as running a win\_shell command with an args, or something else along those lines…? Thanks, John ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [November 15, 2017, 1:12am UTC](https://forum.ansible.com/t/utilizing-win-iis-webbinding-to-update-iis-certs/26023/2 "2017-11-15T01:12:21Z")
The win\_iis\_\* modules are fairly old and have a few bugs associated with them. I started to rewrite them but haven’t really been able to continue due to time commitments and the fact that DSC is probably better suited towards this task. My recommendation is to; - Ensure PowerShell 5.0 is installed - Install the xWebAdministration DSC resource using win\_psmodule [https://github.com/PowerShell/xWebAdministration](https://github.com/PowerShell/xWebAdministration) or manually copy the files to the host ([https://docs.ansible.com/ansible/devel/windows\_dsc.html#custom-dsc-resources](https://docs.ansible.com/ansible/devel/windows_dsc.html#custom-dsc-resources)) - Create a win\_dsc task to modify a website’s bindings using the xWebsite resource ([https://docs.ansible.com/ansible/devel/windows\_dsc.html#setup-iis-website](https://docs.ansible.com/ansible/devel/windows_dsc.html#setup-iis-website)) The only requirements is that PS v5 is installed and that you are using the devel version of win\_dsc, 2.4 does have that module but to be able to supply a dict value the devel one has to be used. If you aren’t using devel and are on a released version, you can create a new file from [https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/windows/win\_dsc.ps1](https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/windows/win_dsc.ps1) and add that to the library path for Ansible so it is available to your roles. It is recommended to rename the file from win\_dsc so you don’t get confused when using a custom module vs an inbuilt one. Thanks Jordan ---
**Author:** ![John\_Martin](https://avatars.discourse-cdn.com/v4/letter/j/4af34b/32.png) [@John\_Martin](https://forum.ansible.com/u/John_Martin)\ **Post date:** [November 15, 2017, 1:43pm UTC](https://forum.ansible.com/t/utilizing-win-iis-webbinding-to-update-iis-certs/26023/3 "2017-11-15T13:43:08Z")
This is great information. Thank you for your help. I will read into the links provided and see if I can work out a resolution with DSC. ---
**Author:** ![John\_Martin](https://avatars.discourse-cdn.com/v4/letter/j/4af34b/32.png) [@John\_Martin](https://forum.ansible.com/u/John_Martin)\ **Post date:** [November 17, 2017, 11:38pm UTC](https://forum.ansible.com/t/utilizing-win-iis-webbinding-to-update-iis-certs/26023/4 "2017-11-17T23:38:09Z")
I was able to successfully import the module, naming it win\_dsc\_devel. I verified it with an adhoc call, passing no parameters, confirming that Ansible sees the module. The problem I’m having, using the win\_dsc example of the module to create an IIS website is that I get errors when attempting to parse the information regarding binding to my machine. ` ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [November 18, 2017, 1:25am UTC](https://forum.ansible.com/t/utilizing-win-iis-webbinding-to-update-iis-certs/26023/5 "2017-11-18T01:25:43Z")
That’s weird I was able to get this task working in an optional integration test when developing these changes here [https://github.com/ansible/ansible/blob/devel/test/integration/targets/win\_dsc/tasks/destructive.yml#L62](https://github.com/ansible/ansible/blob/devel/test/integration/targets/win_dsc/tasks/destructive.yml#L62). Are you able to open a GitHub issue about this and I’ll try and look into it. ---
**Author:** ![Igor\_Turovsky](https://avatars.discourse-cdn.com/v4/letter/i/cdc98d/32.png) [@Igor\_Turovsky](https://forum.ansible.com/u/Igor_Turovsky)\ **Post date:** [March 19, 2019, 12:57pm UTC](https://forum.ansible.com/t/utilizing-win-iis-webbinding-to-update-iis-certs/26023/6 "2019-03-19T12:57:51Z")
Hello, Sorry for replying for very old thread, but I see exactly the same issue with xWebsite. Did you find the cause for it? Thank you, - Igor