D365FO: WinRM certificate error while rotating SSL ceritificate

When cloud-hosted D365FO environment is deployed, SSL certificate is generated for accessing local IIS via HTTPS. This certificate will expire after some time and will trigger HTTPS errors when accessing local D365FO instance. SSL certificate could be regenerated via "Maintain" -> "Rotate secrets" menu. 

In some cases "Rotate secrets" task could fail with the following error: "Attempted to remotely execute a powershell script but the WinRM SSL certificate is expired. Please make sure the virtual machine [vm_name] has a valid WinRM SSL certificate before retrying."

Here is easiest way to refresh WinRM certificate:

1. Login to the remote VM via RDP
2. Open PowerShell prompt as Administrator
3. Run the following command to install d365fo.tools, select "A" to install all modules when prompted:
   

   Install-Module -Name d365fo.tools

   
   
4. Run the following command to refresh WinRM certificate:
   

   Invoke-D365WinRmCertificateRotation

Restart the VM and check if local D365FO instance could be accessed again without certificate error. If the issue still there - execute certificate rotation from LCS one more time, this time it will succeed.