Automatically Renewed SSL: Setup on a Windows Server with win-acme

This guide explains how to use your automatically renewed SSL (ACME) subscription with win-acme for your site running on IIS on Windows Server. You set it up once; after that the certificate is renewed automatically before it expires.

Before you start

• Your subscription must be started: on your service page in the client area, press Configure now and enter your domains.
• The domain must point to this server's IP address and port 80 must be open to the internet. Allow ports 80 and 443 in Windows Firewall and, if you use one, in your network firewall.
• Your domain must be entered as the Host name in your site's bindings in IIS; win-acme finds the site and the domain there.

1. Download win-acme

Download the latest version (x64, zip) from win-acme.com and extract it to a permanent folder such as C:\win-acme. Do not move the folder later; the automatic renewal task runs the program in this folder. On start-up the program may also call itself simple-acme; it is the same program.

2. Get the setup command from the client area

In the client area, open your subscription under Services > SSL Certificates, press Setup commands and copy the command under the Windows Server option with Copy. The command is specific to your subscription: do not share the keys in it.

3. Run win-acme with your subscription details

1. In the Start menu, right-click Command Prompt and choose Run as administrator.
2. Go to the win-acme folder: cd C:\win-acme
3. Paste and run the command you copied from the client area. It looks like this:

wacs.exe --baseuri "https://one.digicert.com/mpki/api/v1/acme/v2/directory" --eab-key-identifier "YOUR_ACCOUNT_KEY" --eab-key "YOUR_HMAC_KEY"

If you run the command in PowerShell, put .\ in front of it: .\wacs.exe --baseuri …

4. Create the certificate

win-acme asks a few questions in turn. The option in brackets or with a star is the default; for most questions you only need to press Enter.

1. Please choose from the menu: N: Create certificate (default settings) is the default; press Enter.
2. Site identifier(s) or <Enter> to choose all: the list of your IIS sites. Press Enter to scan all of them, or type a site's number.
3. Binding identifiers(s) or menu option: the domains on the site (example.com, www.example.com). Press Enter to put all of them on the certificate.
4. Please pick the main host: the domain shown as the main name on the certificate. Press Enter.
5. Continue with this selection? Enter.
6. On first use you are asked about the terms of service: Enter for Open in default application? and Enter for Do you agree with the terms?
7. Email(s): type an e-mail address or leave it empty and press Enter.

win-acme validates the domains, gets the certificate, puts it in the Windows certificate store and adds https bindings on port 443 to your site in IIS. At the end you see Certificate … created; press Q to leave the menu.

5. Check automatic renewal

When the first certificate is created, win-acme adds a single task starting with win-acme renew to Windows Task Scheduler. The task runs every day after 09:00 (with a random delay of up to a few hours) and renews certificates that are due. win-acme renews the certificate well before it expires, about every two months; the first renewal date is shown on the Next renewal due after line when the certificate is created.

Common problems

• Validation failed: the domain does not point to this server or port 80 is closed. Check the DNS record and your firewall.
• The site is not listed or the domain is missing: add the domain as a host name to the site's bindings in IIS.
• Invalid --baseuri specified: the command was not copied completely. Copy it again from the window in the client area.
• Unable to verify Hmac: the HMAC key is wrong or missing. Copy the command again from the window in the client area.
• Unable to process new order request (domain_not_allowed): one of the domains you chose is not on the subscription. Add it to your subscription in the client area first.

If you get stuck at any step, you can open a support ticket from the client area.