ACME SSL certificate on Windows Server IIS with win-acme

On a Windows VPS or server with IIS, the free win-acme client can obtain a Sectigo certificate from your ACME subscription with a single command, add the HTTPS binding to the site and create a scheduled task that renews the certificate. Below you will find what to prepare in IIS, the command with the right parameters and how to check renewals.

What you need

• Administrator access to the server over Remote Desktop.
• IIS with the site already working over HTTP.
• An HTTP binding on port 80 with a host name for each name you want in the certificate (for example example.com and www.example.com). win-acme picks the names from these bindings; a binding with an empty host name is not enough.
• The domain's DNS records pointing to the server, and ports 80 and 443 allowed in Windows Defender Firewall.
• The Server URL, EAB MAC ID and EAB MAC Key from Sectigo ACME Certificate-as-a-Service.

Step 1. Check the bindings in IIS

1. Open Internet Information Services (IIS) Manager: from Server Manager, Tools menu, or by running inetmgr.
2. In the Connections panel, expand the server, then Sites, and select your site.
3. Click Bindings in the Actions panel.
4. Make sure there is an http binding on port 80 for each name. If one is missing, click Add, choose Type http, Port 80, type the name in Host name and confirm.

Step 2. Download win-acme

1. Download the latest release for your system (usually x64) from the official site, www.win-acme.com.
2. Before extracting, right-click the ZIP file, open Properties and tick Unblock if Windows shows that option; otherwise Windows may stop the program from running.
3. Extract the archive to a permanent folder, for example C:\Program Files\win-acme. Do not leave it in Downloads: the renewal task runs the program from this folder.

Step 3. Issue and install the certificate

Open Windows PowerShell as administrator and run the command below with your own values. In PowerShell a line continues on the next one when it ends with a backtick (`); you can also write everything on one line.

& "C:\Program Files\win-acme\wacs.exe" `
  --source iis --host example.com,www.example.com `
  --baseuri https://acme.sectigo.com/v2/DV `
  --eab-key-identifier YOUR_EAB_MAC_ID --eab-key YOUR_EAB_MAC_KEY `
  --emailaddress admin@example.com --accepttos `
  --store certificatestore --installation iis

win-acme validates the domain over HTTP, installs the certificate and, on the first run, creates a task in Task Scheduler for renewals. If something fails, run the same command with --verbose added to see each step in detail.

Step 4. Confirm the result

• Open https://example.com in a browser and check the certificate behind the padlock: issuer, names and expiry date.
• In IIS Manager, open Bindings for the site again: there should now be an https binding on port 443 with the new certificate selected.
• In Task Scheduler, find the task whose name begins with win-acme renew. It runs every day and renews the certificate when it is due.

Step 5. Check and test renewals

win-acme stores its renewals separately for each ACME server, so always pass the same --baseuri you used for issuance:

& "C:\Program Files\win-acme\wacs.exe" --list --baseuri https://acme.sectigo.com/v2/DV
& "C:\Program Files\win-acme\wacs.exe" --renew --force --baseuri https://acme.sectigo.com/v2/DV

The first command shows the registered renewals and their next date. The second forces an immediate renewal; use it once to test, not regularly. Without --baseuri, win-acme looks at its default server and shows an empty list, which often looks like the renewal was lost.

Common problems

• No bindings found / the host is not found. The site has no HTTP binding with that host name. Add it as in step 1.
• Validation times out. Port 80 is blocked in Windows Defender Firewall or by another firewall, or DNS still points to another server.
• unauthorized or account errors. The EAB MAC ID or EAB MAC Key were copied incompletely, or the requested name is not in the domain list of the subscription.
• The browser shows the wrong certificate on a server with several sites. Check that each HTTPS binding has its host name filled in and Require Server Name Indication ticked.
• Renewal does not happen. The task was deleted or disabled, or the win-acme folder was moved after installation. Run the command from step 3 again from the permanent folder.

win-acme writes detailed logs in C:\ProgramData\win-acme. If you need help, open a ticket and attach the relevant part of the log, without the EAB MAC Key.

Related articles

• Sectigo ACME Certificate-as-a-Service: order and credentials
• Paid SSL certificate: order, validation and installation
• Certbot on Apache and Nginx