# Free Let's Encrypt certificates on Windows and IIS with win-acme

win-acme (`wacs.exe`) is a free, open-source Let's Encrypt client for
Windows. For an IIS site it does the whole job: proves control of the domain,
puts the certificate in the Windows certificate store, updates the HTTPS
binding and creates a scheduled task that renews it.

On Linux, see [Free SSL from Let's Encrypt with Certbot](/guides/free-ssl-certificate-lets-encrypt).

## Before you start

- The site already works over HTTP in IIS, with a host name binding for each
  name you want on the certificate.
- DNS for those names points at this server, and **port 80 is open** from the
  internet. win-acme's default check (HTTP-01) serves a file through IIS.
- You can run programs as Administrator on the server.

## Step 1: download

Get the latest release from [win-acme.com](https://www.win-acme.com/) or its
[GitHub releases](https://github.com/win-acme/win-acme/releases): the x64
"pluggable" zip suits most servers. Extract it to a permanent folder such as
`C:\win-acme`. The scheduled task runs from that folder, so don't use
Downloads or a temporary directory.

## Step 2: create the certificate

Open an elevated command prompt in that folder and run:

```
wacs.exe
```

Then:

1. Choose **N: Create certificate (default settings)**.
2. Pick the IIS site, then the bindings (host names) to include.
3. Accept the Let's Encrypt terms and give an email address.

win-acme validates each name, stores the certificate (normally in the
**WebHosting** store), adds or updates the `https` binding on port 443 and
removes the old certificate from it.

## Step 3: check the renewal task

win-acme creates a task in Task Scheduler that runs daily and renews
certificates well before they expire. Check it exists and has run:

```
schtasks /query /tn "win-acme renew (acme-v02.api.letsencrypt.org)"
```

To test a renewal now, run `wacs.exe`, choose **R: Run renewals**, or force
one with `wacs.exe --renew --force`.

Two things that break renewals on Windows:

- **The folder moved or was deleted.** The task points at `wacs.exe` where
  you first ran it.
- **Port 80 was closed later**, or a redirect rule sends
  `/.well-known/acme-challenge/` somewhere else. Exclude that path from
  HTTP-to-HTTPS redirects.

## Remote Desktop, Exchange and other services

IIS bindings are updated for you. Other services that use the certificate,
such as RD Gateway, RD Web Access or Exchange, keep the old one until you
tell them. win-acme can run a script after each renewal (the
"installation" step accepts a PowerShell script) to import the new
certificate into those services. Without one, the site renews and the other
service expires. The
[IIS and RDS runbook](/guides/iis-rds-replace-certificate) and the
[Exchange hybrid guide](/guides/exchange-hybrid-certificate-renewal) cover
what each service needs.

## Alternatives

- [Certify The Web](https://certifytheweb.com/): a desktop app with a
  dashboard, free for a few certificates.
- [Posh-ACME](https://poshac.me/docs/): a PowerShell module, good for
  scripted setups and DNS validation.

## Check your domain

The [SSL expiry checker](/tools/ssl-expiry-checker) shows which certificate
each hostname actually serves. If the date didn't move after a renewal, the
new certificate isn't bound. See
[certificate renewed but not installed](/guides/certificate-renewed-but-not-installed).

## Sources

- [win-acme: getting started](https://www.win-acme.com/manual/getting-started)
- [win-acme: renewal](https://www.win-acme.com/manual/renewal)
- [win-acme: settings reference](https://www.win-acme.com/reference/settings)
- [win-acme releases](https://github.com/win-acme/win-acme/releases)
- [Let's Encrypt: challenge types](https://letsencrypt.org/docs/challenge-types/)

---
Source: https://nameward.app/guides/lets-encrypt-iis-win-acme (updated 2026-10-30)