Understanding and Fixing WinRM Certificate Error

Error Description

This error occurs when you attempt to establish a remote connection via Windows Remote Management (WinRM) using HTTPS, but the SSL/TLS certificate used to secure the connection fails validation. The WinRM client is highly strict about identity verification.

The error highlights a specific certificate architecture failure:

• Missing DNS Name: The certificate lacks a valid routing identifier (like the hostname or Fully Qualified Domain Name) inside the Subject Name or Subject Alternative Name (SAN) fields.
• Presence of a UPN: The certificate mistakenly includes a User Principal Name (UPN) (e.g., user@domain.com), which indicates it was issued for user authentication rather than computer/host authentication.

WinRM requires a dedicated machine certificate to verify that the remote computer is exactly who it claims to be before passing sensitive credentials.

Step-by-Step Fix: Generate and Bind a Valid Certificate

To fix this issue, you must generate a compliant computer certificate and bind it to the WinRM HTTPS listener. Follow these exact steps on the target remote machine.

Step 1: Open PowerShell as Administrator

1. Press the Windows Key on your keyboard.
2. Type PowerShell.
3. Right-click Windows PowerShell from the results.
4. Select Run as administrator.

Step 2: Create a Compliant Self-Signed Certificate

Run the following command to create a certificate that explicitly uses the computer's Fully Qualified Domain Name (FQDN) in the Subject field and ensures no UPN is attached.

New-SelfSignedCertificate -DnsName \(env:COMPUTERNAME -CertStoreLocation Cert:\LocalMachine\My -Subject\)env:COMPUTERNAME

Note down the Thumbprint string displayed in the output. You will need it for the next steps.

Step 3: Delete the Existing Broken WinRM HTTPS Listener

If you previously tried to configure WinRM HTTPS, an invalid listener might be blocking the port. Remove it by running:

Remove-Item -Path WSMan:\Localhost\Listener\* -Recurse -ErrorAction SilentlyContinue

Step 4: Create a New WinRM HTTPS Listener with the Valid Certificate

Replace YOUR CERTIFICATE THUMBPRINT with the string you copied from Step 2, then run the command:

New-Item -Path WSMan:\LocalHost\Listener -Transport HTTPS -Address * -CertificateThumbprint "YOUR CERTIFICATE THUMBPRINT"

Step 5: Open Port 5986 in the Windows Firewall

WinRM HTTPS traffic communicates over port 5986. Ensure your firewall allows this traffic by executing:

New-NetFirewallRule -DisplayName "Windows Remote Management (HTTPS-In)" -Name "WinRM HTTPS" -Profile Any -LocalPort 5986 -Protocol TCP -Action Allow -Direction Inbound

Step 6: Verify the Setup

Check if the listener is active and correctly configured with your new certificate parameters:

winrm enumerate winrm/config/listener

Look for the entry where Transport = HTTPS to ensure your host matches the certificate attributes. You can now safely attempt your remote connection from the client machine.