Certificates on IIS

win-acme manages all IIS site certificates automatically via Let's Encrypt HTTP-01 challenge.

win-acme — IIS site certificates

win-acme issues and auto-renews certificates for every IIS site that has an HTTP binding. A Windows Scheduled Task handles renewals automatically (55 days before expiry, daily at 9 AM).

Install

Download the pluggable build from github.com/win-acme/win-acme/releases and extract it to C:\Program Files\win-acme\.

Create the renewal (interactive)

Run as Administrator:

wacs.exe

In the menu:

  1. M — Create certificate (full options)
  2. Source → 2 IIS → 3 All sites (any host, HTTP bindings only — this picks up every site automatically)
  3. Validation → 1 HTTP challenge — IIS handles the /.well-known/acme-challenge/ requests automatically
  4. CSR → 1 RSA (default)
  5. Store → 1 Windows Certificate Store → accept defaults (ACL: Administrators)
  6. Install → 1 IIS — binds the certificate to every matching HTTPS binding
  7. Confirm and let it run. It will issue the cert and create the Scheduled Task.

How new sites get HTTPS automatically

When you add a new IIS site with only an HTTP binding, win-acme's scheduled task adds the HTTPS binding automatically — no manual action needed.

The scheduled task runs wacs.exe --renew daily at 9 AM (with up to 4 hours random delay). On each run, wacs re-scans all IIS sites that have an HTTP binding, adds any new hostnames to the certificate's SAN list, reissues the cert, and the IIS install plugin creates the HTTPS binding for the new site.

The new HTTPS binding will appear within 24 hours. To apply it immediately, run as Administrator:

wacs.exe --renew --baseuri "https://acme-v02.api.letsencrypt.org/"

Verify the scheduled task

Get-ScheduledTask -TaskName "win-acme*"

The task should exist and show Ready status. wacs also self-checks on launch:

wacs.exe --verbose

Renewal data location

C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\

The renewal JSON (*.renewal.json) stores all settings. Back this up if you want to avoid re-running the wizard after a reinstall — place it back in that folder and wacs will pick it up.