Windows Admin Center TLS Certificate: Replacing the Self-Signed Certificate

Windows Admin Center (WAC) installs with a self-signed certificate that generates browser warnings every time you open it. When WAC is deployed in Gateway mode on a Windows Server (accessible to multiple admins over the network), this warning is more than cosmetic — it means you cannot verify you are connecting to the legitimate WAC instance. This article covers replacing the self-signed certificate with one from an Active Directory Certificate Services (ADCS) internal CA or a public CA, using both the WAC installer and PowerShell.

How WAC manages its certificate

WAC is a web application running as a Windows service (ServerManagementGateway). It listens on port 443 (or a custom port) and uses a certificate stored in the Windows Local Machine certificate store (Cert:\LocalMachine\My). The certificate’s thumbprint is stored in the WAC configuration.

WAC in two modes:

Mode	Where installed	Certificate	Typical use
Desktop mode	Admin workstation	Self-signed (auto)	Single admin use
Gateway mode	Windows Server	Configurable	Shared team access

This article focuses on Gateway mode where certificate management matters.

Method 1: Replace the certificate during WAC installation

The cleanest approach is to import the correct certificate before running the WAC installer. The installer accepts a thumbprint parameter.

Step 1: Import the certificate into the Windows Certificate Store

Import the PFX into LocalMachine\My:

$pfxPassword = ConvertTo-SecureString -String "PFXpassword" -AsPlainText -Force
Import-PfxCertificate `
    -FilePath "C:\Certs\wac.example.com.pfx" `
    -CertStoreLocation "Cert:\LocalMachine\My" `******

Or request from your internal AD CS:

# Request a certificate from an AD CS template
$cert = Get-Certificate `
    -Template "WebServer" `
    -SubjectName "CN=wac.example.com" `
    -DnsName "wac.example.com" `
    -CertStoreLocation "Cert:\LocalMachine\My"

$thumb = $cert.Certificate.Thumbprint

Step 2: Install WAC with the thumbprint

msiexec /i WindowsAdminCenter.msi /qn /L*v log.txt REGISTRY_REDIRECT_PORT_80=1 SME_PORT=443 SME_THUMBPRINT=<thumbprint> SSL_CERTIFICATE_OPTION=installed

Or with PowerShell:

$thumb = "YOURCERTIFICATETHUMBPRINT"
Start-Process msiexec -ArgumentList "/i", "WindowsAdminCenter.msi", "/qn", "SME_PORT=443", "SME_THUMBPRINT=$thumb", "SSL_CERTIFICATE_OPTION=installed" -Wait

Method 2: Replace the certificate on an existing WAC installation

If WAC is already installed with the self-signed certificate, replace it without reinstalling.

Step 1: Import the new certificate

# Import from PFX
$pfxPassword = ConvertTo-SecureString -String "PFXpassword" -AsPlainText -Force
$cert = Import-PfxCertificate `
    -FilePath "C:\Certs\wac.example.com.pfx" `
    -CertStoreLocation "Cert:\LocalMachine\My" `******

$newThumbprint = $cert.Thumbprint
Write-Host "New certificate thumbprint: $newThumbprint"

Step 2: Update the WAC port binding

WAC uses an HTTP.sys SSL binding. Update it to use the new certificate:

# Remove the old binding
$port = 443
netsh http delete sslcert ipport=0.0.0.0:$port

# Add the new binding
# Note: AppID must be the same GUID that WAC registered
# Find the correct AppID first:
netsh http show sslcert ipport=0.0.0.0:443

# Then re-add with the new thumbprint
$appId = "{your-wac-appid-guid}"  # from the show command above
$newThumbprint = "YOURNEWCERTTHUMBPRINT"

netsh http add sslcert ipport=0.0.0.0:$port `
    certhash=$newThumbprint `
    appid=$appId

Step 3: Update the WAC configuration file

WAC stores the certificate thumbprint in its configuration. Update the Windows registry:

$regPath = "HKLM:\SOFTWARE\Microsoft\ServerManagementGateway"

# Update the thumbprint
Set-ItemProperty -Path $regPath -Name "SslCertificateThumbprint" -Value $newThumbprint

# Verify
Get-ItemProperty -Path $regPath | Select-Object -Property SslCertificateThumbprint

Step 4: Restart the WAC service

Restart-Service ServerManagementGateway
Get-Service ServerManagementGateway | Select-Object -Property Status, StartType

Step 5: Verify

Open a browser and navigate to https://wac.example.com. The browser should no longer show a certificate warning.

Verify via PowerShell:

# Check the binding
netsh http show sslcert ipport=0.0.0.0:443

# Check the certificate details
$thumb = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\ServerManagementGateway").SslCertificateThumbprint
Get-ChildItem "Cert:\LocalMachine\My\$thumb" | Select-Object -Property Subject, NotAfter, Issuer

Method 3: Use the WAC Settings page (WAC 2103 and later)

Newer versions of WAC include a certificate management page:

1. Open WAC and navigate to Settings → General → Certificate.
2. Click Change Certificate.
3. A dropdown shows all certificates in Cert:\LocalMachine\My.
4. Select the new certificate.
5. Click Save.
6. WAC restarts automatically.

Using a Let’s Encrypt certificate with WAC

WAC does not have a built-in ACME client, but you can use win-acme (WACS) to automate Let’s Encrypt on Windows:

Install win-acme

# Download from https://www.win-acme.com/ or via winget
winget install win-acme.win-acme

Request and configure a certificate

wacs.exe --target manual --host wac.example.com --store certificatestore --certificatestore My --installation script --script "C:\Scripts\update-wac-cert.ps1" --scriptparameters "{CertThumbprint}"

Create C:\Scripts\update-wac-cert.ps1:

param([string]$CertThumbprint)

Write-Host "Updating WAC certificate to thumbprint: $CertThumbprint"

$port = 443
$regPath = "HKLM:\SOFTWARE\Microsoft\ServerManagementGateway"

# Get the old appId from existing binding
$oldBinding = netsh http show sslcert ipport=0.0.0.0:$port | Out-String
$appIdMatch = $oldBinding -match "Application ID\s+: ({[^}]+})"
$appId = if ($matches) { $matches[1] } else { "{ba4a5cc0-78e7-4e58-ae73-3bd252d63d2e}" }

# Remove old binding and add new one
netsh http delete sslcert ipport=0.0.0.0:$port
netsh http add sslcert ipport=0.0.0.0:$port certhash=$CertThumbprint appid=$appId

# Update registry
Set-ItemProperty -Path $regPath -Name "SslCertificateThumbprint" -Value $CertThumbprint

# Restart service
Restart-Service ServerManagementGateway

Write-Host "WAC certificate updated successfully"

win-acme renews the certificate automatically before expiry and runs the script to update WAC.

Deploying WAC behind a reverse proxy

An alternative to managing TLS on WAC directly is to put it behind IIS or nginx (via WSL or as a Windows service) as a TLS terminator, and configure WAC to listen on plain HTTP on a non-standard port:

1. Install WAC on port 6516 without TLS:

msiexec /i WindowsAdminCenter.msi /qn SME_PORT=6516 SSL_CERTIFICATE_OPTION=generate

2. Configure IIS with TLS on port 443 and reverse proxy to localhost:6516.

However, WAC’s browser-managed authentication and some features work best with a direct HTTPS connection, not behind a proxy. Check the WAC documentation for your version before implementing this.

Certificate requirements for WAC

The certificate must:

• Have a CN or SAN matching the hostname users access (wac.example.com or the server’s FQDN)
• Include Server Authentication EKU (1.3.6.1.5.5.7.3.1)
• Be installed in Cert:\LocalMachine\My (not CurrentUser)
• Have an exportable private key (if you need to move it between servers)

Troubleshooting

Problem	Cause	Fix
WAC service fails to start after cert change	Thumbprint in registry does not match installed cert	Verify thumbprint: Get-ChildItem Cert:\LocalMachine\My
Browser still shows self-signed cert warning	HTTP.sys binding not updated	Re-run the netsh http add sslcert command
Access denied running netsh	Not running as Administrator	Open PowerShell as Administrator
Certificate dropdown in Settings is empty	Certificate not in LocalMachine\My	Re-import the PFX with -CertStoreLocation Cert:\LocalMachine\My
WAC works but shows partial warning	Intermediate certificate missing	Import a chain that includes the full certificate chain

Summary

Replacing the WAC self-signed certificate requires importing the new certificate into Cert:\LocalMachine\My, updating the HTTP.sys SSL binding with netsh http add sslcert, updating the thumbprint in the HKLM:\SOFTWARE\Microsoft\ServerManagementGateway registry key, and restarting the ServerManagementGateway service. Newer WAC versions (2103+) include a Settings page that handles the binding and registry update automatically. For automated renewal, use win-acme with a post-install script that updates the WAC binding.