win-acme (wacs.exe) is a free, open-source Let's Encrypt client for
Windows. For an IIS site it does the whole job: proves control of the domain,
puts the certificate in the Windows certificate store, updates the HTTPS
binding and creates a scheduled task that renews it.
On Linux, see Free SSL from Let's Encrypt with Certbot.
Before you start
- The site already works over HTTP in IIS, with a host name binding for each name you want on the certificate.
- DNS for those names points at this server, and port 80 is open from the internet. win-acme's default check (HTTP-01) serves a file through IIS.
- You can run programs as Administrator on the server.
Step 1: download
Get the latest release from win-acme.com or its
GitHub releases: the x64
"pluggable" zip suits most servers. Extract it to a permanent folder such as
C:\win-acme. The scheduled task runs from that folder, so don't use
Downloads or a temporary directory.
Step 2: create the certificate
Open an elevated command prompt in that folder and run:
wacs.exe
Then:
- Choose N: Create certificate (default settings).
- Pick the IIS site, then the bindings (host names) to include.
- Accept the Let's Encrypt terms and give an email address.
win-acme validates each name, stores the certificate (normally in the
WebHosting store), adds or updates the https binding on port 443 and
removes the old certificate from it.
Step 3: check the renewal task
win-acme creates a task in Task Scheduler that runs daily and renews certificates well before they expire. Check it exists and has run:
schtasks /query /tn "win-acme renew (acme-v02.api.letsencrypt.org)"
To test a renewal now, run wacs.exe, choose R: Run renewals, or force
one with wacs.exe --renew --force.
Two things that break renewals on Windows:
- The folder moved or was deleted. The task points at
wacs.exewhere you first ran it. - Port 80 was closed later, or a redirect rule sends
/.well-known/acme-challenge/somewhere else. Exclude that path from HTTP-to-HTTPS redirects.
Remote Desktop, Exchange and other services
IIS bindings are updated for you. Other services that use the certificate, such as RD Gateway, RD Web Access or Exchange, keep the old one until you tell them. win-acme can run a script after each renewal (the "installation" step accepts a PowerShell script) to import the new certificate into those services. Without one, the site renews and the other service expires. The IIS and RDS runbook and the Exchange hybrid guide cover what each service needs.
Alternatives
- Certify The Web: a desktop app with a dashboard, free for a few certificates.
- Posh-ACME: a PowerShell module, good for scripted setups and DNS validation.
Check your domain
The SSL expiry checker shows which certificate each hostname actually serves. If the date didn't move after a renewal, the new certificate isn't bound. See certificate renewed but not installed.