Free SSL for IIS with win-acme and Let's Encrypt

win-acme is a free, open-source tool that gets certificates from Let's Encrypt, adds them to IIS and renews them automatically. In about ten minutes your IIS site can serve HTTPS.

Before you start

• IIS is installed and your site has an http binding with a host name, for example www.example.com. See Install IIS and host a website.
• The domain's DNS A record already points to this server.
• Port 80 is reachable from the internet. Let's Encrypt checks it to confirm you control the domain. Port 443 must be open too for HTTPS visitors.

1. Download win-acme

1. On the server, go to the official site, win-acme.com, and download the latest release for your system (the x64 "pluggable" or "trimmed" zip).
2. Extract it to a permanent folder, for example C:\Tools\win-acme. The renewal task runs from here, so do not delete it later.

2. Request the certificate

1. Open C:\Tools\win-acme and run wacs.exe as Administrator.
2. Choose N: Create certificate (default settings).
3. Choose your IIS site from the list, then select the host names to include (or press Enter for all of them).
4. Enter an email address for expiry warnings and accept the Let's Encrypt terms when prompted.

win-acme validates the domain, installs the certificate, adds an https binding on port 443 to your site and creates a scheduled task that renews the certificate before it expires.

3. Check it

Open https://www.example.com from your own computer. The browser should show a padlock. Confirm the renewal task exists:

Get-ScheduledTask | Where-Object TaskName -like "win-acme*"

4. Redirect HTTP to HTTPS (optional)

Install Microsoft's URL Rewrite module for IIS, then add this inside <system.webServer> in your site's web.config:

<rewrite>
  <rules>
    <rule name="To HTTPS" stopProcessing="true">
      <match url="(.*)" />
      <conditions><add input="{HTTPS}" pattern="off" /></conditions>
      <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
    </rule>
  </rules>
</rewrite>

Troubleshooting

• Validation failed: check that DNS points to this server (nslookup www.example.com), that port 80 is allowed in the firewall, and that the http binding uses exactly that host name.
• Rate limit messages: Let's Encrypt limits repeated failed attempts. Fix the cause, wait an hour and try again.
• Certificate did not renew: run wacs.exe and choose the option to run renewals manually to see the error.

Next steps

• Install the.NET Hosting Bundle for IIS
• Schedule tasks with Task Scheduler