Updated October 2026: "Let's Encrypt Win Simple" is now win-acme. This version walks through win-acme on current Windows Server, adds an unattended command for scripts, and covers the errors people run into most.
Quick Answer
- Download win-acme from win-acme.com and unzip it on the IIS server (for example to
C:\win-acme). - Run
wacs.exeas Administrator, choose N (create a certificate with default settings), and pick your IIS site. - win-acme proves you own the domain, gets the certificate, adds the HTTPS binding in IIS, and creates a scheduled task that renews it automatically.
Why Use HTTPS?
HTTPS encrypts the connection between the browser and your server, so passwords and form data can't be read or changed in transit. Browsers label plain-HTTP pages as "Not secure," many browser features only work over HTTPS, and Google has used HTTPS as a ranking signal since 2014. With free, automated certificates there is no reason left to run without it.
Before You Start
- The domain's DNS must point at the server, and port 80 must be reachable from the internet. Let's Encrypt validates over HTTP by requesting a file under
/.well-known/acme-challenge/. - The site needs an HTTP binding in IIS with the host name (for example
example.comandwww.example.com). win-acme reads the host names from the bindings. - Open port 443 in Windows Firewall and any cloud firewall.
Step-by-Step With win-acme
REM Interactive: pick "N" (create certificate, default settings), then choose the IIS site
C:\win-acme\wacs.exe
REM Unattended (for scripts): certificate for all host names bound to IIS site 1
C:\win-acme\wacs.exe --source iis --siteid 1 --emailaddress admin@example.com --accepttos
REM List the renewals and the scheduled task win-acme created
C:\win-acme\wacs.exe --list- One certificate for www and non-www: if both host names are bound to the site, win-acme puts both on the same certificate. Then redirect one to the other.
- Many sites on one IP: win-acme creates the HTTPS bindings with SNI (Server Name Indication), which IIS 8 and later support, so each site can have its own certificate on a shared IP.
- Renewal: Let's Encrypt certificates are short-lived (90 days, and Let's Encrypt has announced plans to shorten that further), so never renew by hand. win-acme's scheduled task runs daily and renews well before expiry. Check it occasionally in Task Scheduler.
Common Problems
- Validation fails: port 80 is blocked, DNS points elsewhere, or a rule redirects or blocks
/.well-known/acme-challenge/. If you force HTTPS with URL Rewrite, add an exception for that path. - Behind Cloudflare or another proxy: HTTP validation usually still works through the proxy, but if it doesn't, use DNS validation (win-acme supports many DNS providers) or the proxy's own origin certificates.
- Wildcard certificates (
*.example.com) require DNS validation. - Rate limits: repeated failed attempts can hit Let's Encrypt's limits. Test with win-acme's test mode (
--test) while experimenting.
Other Options
- Certify The Web: a GUI app for managing ACME certificates on Windows, free for a limited number of certificates.
- Posh-ACME: a PowerShell module for ACME, useful in your own automation.
- A CDN or reverse proxy that terminates HTTPS for you, with a separate certificate between the proxy and IIS.
I first learned about this approach from Rick Strahl's post on Let's Encrypt with IIS, which is still a good read on the details.
Frequently Asked Questions
Is Let's Encrypt free for IIS?
Yes. Let's Encrypt certificates are free and trusted by all major browsers. On IIS you use a free ACME client such as win-acme to request, install and renew them.
How do I renew a Let's Encrypt certificate on IIS?
win-acme creates a scheduled task that renews automatically and updates the IIS binding. To renew manually, run wacs.exe and choose to run renewals.
What happened to Let's Encrypt Win Simple?
It was renamed win-acme. The tool and its approach are the same, with many more features.
Related: redirecting www and non-HTTPS traffic in ASP.NET Core.
