Install an ACME SSL Certificate on Windows IIS (Win-ACME)

This guide explains how to install an ACME-based SSL certificate for a website hosted on Windows Server with IIS using the Win-ACME client.

Prerequisites

• Administrative access to the Windows Server (via RDP)
• Windows IIS installed and configured
• HTTP binding (port 80) configured for the domain in IIS
• Access to the ACME server (e.g. https://acme.sectigo.com/v2/DV)
• EAB credentials (EAB_KID and EAB_HMAC_KEY)

Important note: the certificate will not work if the site only has a wildcard/default binding without a specific hostname.

1. Install Win-ACME

Download the latest Win-ACME version:

• Go to the official Win-ACME website
• Download the ZIP archive
• Extract it to:

C:\Program Files\Win-ACME

Verify execution:

• Navigate to the folder
• Run wacs.exe

2. Install SSL Certificate

Open PowerShell as Administrator and run:

& "C:\Program Files\Win-ACME\wacs.exe" --source iis --host yourdomain.com \
--store certificatestore --installation iis \
--baseuri https://acme.sectigo.com/v2/DV \
--eab-key-identifier EAB_KID \
--eab-key EAB_HMAC_KEY \
--accepttos

Parameters:

• SERVER / baseuri – ACME server URL provided by CA
• EAB_KID – ACME authentication ID
• EAB_HMAC_KEY – ACME authentication key
• yourdomain.com – main domain

For multiple domains:

--host "yourdomain.com,www.yourdomain.com"

Tip: if an error occurs, add --verbose for detailed output.

3. Confirm installation

Verify SSL installation by visiting:

• https://yourdomain.com

Check IIS configuration:

• Server Manager → Tools → Internet Information Services (IIS) Manager
• Select server → Sites → your site
• Check Bindings
• Ensure HTTPS (port 443) binding exists

4. ACME verification and renewal

Win-ACME automatically manages certificate renewal.

To check ACME configuration:

& "C:\Program Files\Win-ACME\wacs.exe" --list --baseuri https://acme.sectigo.com/v2/DV/

Important note: each certificate is tied to a specific ACME server. The --baseuri parameter must match the one used during issuance.

Summary

• ACME-issued SSL certificate
• Automatic IIS integration
• HTTPS binding configured
• Automatic renewal enabled