Iis – When should I not use IIS 8.5’s automatic cert rebinding feature

It is not IIS fault. Looks like you downloaded wrong intermediate CA certificate or incorrectly merged certificates with OpenSSL.

IIS internally builds certificate chain and uses these certificates (except root certificate, which is not transmitted during SSL handshake) to send to client. Even if the certificate is not presented in the store, IIS can use Authority Information Access certificate extension to retrieve missing issuer certificate.

Based on your output, intermediate CA certificate (in the PFX bundle) is not the right issuer of your certificate. If you could send us (or post here) public part of your certificate, I would provide more information on what is happening. But most likely, the problem is on StartCom side.

Edit 17.07.2015

I examined your output and found that StartSSL made a bad decision when they renewed their intermediate CA certificate. They reused the key pair and as the result, multiple identical chains can be generated for your certificate through different intermediate CA certificates and a single root. Depending on a number of factors, either chain can be selected by chaining engine.

A good practice is to renew CA certificate with a new key pair when any significant information is chnged in the CA cert.

What you shall to do (if possible):

1. remove bindings in IIS.
2. export SSL certificate to PFX. In the export wizard, uncheck the option that includes all certificates in the chain and mark to delete the private key if export is successful.
3. delete the certificate from store and clear CryptoAPI cache: certutil -urlcache * delete.
4. install proper StartSSL CA certificate in the Local Machine\Intermediate CAs: (https://www.startssl.com/certs/class2/sha2/der/sub.class2.server.sha2.ca.crt)
5. install exported PFX to machine store (Personal container). You may select to mark private key as exportable during import operation.
6. Double-click the certificate, switch to Certification Path tab, select intermediate CA certificate -> View Certificate and check whether it is a proper SHA256 cert.
7. configure SSL bindings in IIS.

A redirect from http://old.example.com to https://new.example.com does not require a certificate for old.example.com. But a redirect from https://old.example.com to https://new.example.com does.

If people's bookmarks or search engine search results or other external links point to the https site, you better renew the cert. If you merely assume that people type old.example.com into their browser, you may not need it. (However, if they were on your site before and the browser autocompletes to the https-url, you still need it).

As I understand you already have the redirection in place for some time, the best thing to check (as Tim Brigham already said) your web logs and evaluate whether it is worth the hassle. Then again, even if for some reason you need an expensive cert for your main site (for example, with Extended Validation), the redirecting site should be fine with one of the generally accepted free certs (startssl, letsencrypt, ...)