This message was deleted.

Not certain about that myself, but I had that before and had issues I recall. make sure the one that had the thumbprint is active Powershell 1. Set-Location Cert:\LocalMachine\My 2. Get-ChildItem | Format-Table Subject, FriendlyName, Thumbprint -AutoSize Then you can remove the one that is old delete sslcert ipport=0.0.0.0:443 or delete sslcert ipport=machineIP:443 Or you can get rid of them both and use this instead which makes is so simpler. Go to option 2. Very easy scripted way by @James Kindon https://blogs.mycugc.org/2023/07/27/securing-xml-traffic-citrix/

Not sure either, but in general I only do the first of the two just in case some IP changes on customer config where they don't reserve IP addresses. I don't ever do the binding to the IP specifically. That is if you are needing to have different certs on different IPs for multi homing purposes and different bindings, etc. It works, but yeah, only need to have the one