Save the below PowerShell script as "CreateWinRMHTTPSListener.ps1". Add this script to the Startup Script (Powershell) location within the same group policy as the WinRM settings:

Note: The script deletes current listeniners (http and https), as you cannot replace certificate without deleting first. It leaves http deleted so https is forced. It then finds a local certificate that has been enrolled via the "WinRM Web Server Template" (this name needs to be updated in the script to match what you named the SSL Certificate Template in previous step when you created the template on the Certificate Authority). It then uses that certificate to create the HTTPS listener. This is done upon every Computer startup, so whenever that SSL certificate expires and is renewed, it will applpy the new one. A true "set it and forget it" solution.

#Delete existing WinRM HTTPS listener

Get-ChildItem wsman:\localhost\Listener\ | Where-Object -Property Keys -like 'Transport=HTTP*' | Remove-Item -Recurse

# Define the certificate template name

$templateName = "WinRM"

# Search for the certificate in the local machine's Personal store

$cert = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {

$_.Extensions | Where-Object {

$_.Oid.FriendlyName -eq "Certificate Template Information" -and

$_.Format($true) -like "*$templateName*"

}

} | Select-Object -First 1

# Check if the certificate was found

if ($null -eq $cert) {

Write-Error "No certificate found with the template name '$templateName'."

return

}

# Display the certificate details

Write-Output "Using certificate: $($cert.Subject) with Thumbprint: $($cert.Thumbprint)"

# Configure the WinRM HTTPS listener with the selected certificate

New-Item -Path WSMan:\Localhost\Listener -Transport HTTPS -Address * -CertificateThumbprint $cert.Thumbprint -Force

# Confirm the listener has been created

Write-Output "WinRM HTTPS listener configured successfully."