English

简体中文

English

简体中文

Appearance

Windows IIS Setup ​

For Windows Server with IIS.

This guide uses Win-ACME to issue, install, and renew the certificate automatically.

Requirements ​

  • You can access the server through RDP.
  • IIS already has a binding for the domain, at least on port 80.
  • The domain points to this server.
  • You have the Server URL, EAB MAC ID, and EAB MAC key.

TIP

If the IIS site only has a default wildcard binding, Win-ACME may not identify it correctly. Add a clear Host Name binding first.

1. Install Win-ACME ​

  1. Open https://www.win-acme.com/.
  2. Download the latest release.
  3. Extract it to:
text
C:\Program Files\Win-ACME
  1. Run wacs.exe once to confirm it works.

2. Issue and Install ​

Open PowerShell as Administrator.

Single domain, including the root domain and www by default:

powershell
& "C:\Program Files\Win-ACME\wacs.exe" `
  --source iis `
  --host "example.com,www.example.com" `
  --store certificatestore `
  --installation iis `
  --baseuri "your Server URL" `
  --eab-key-identifier "your EAB MAC ID" `
  --eab-key "your EAB MAC key" `
  --accepttos

Multi-domain:

powershell
& "C:\Program Files\Win-ACME\wacs.exe" `
  --source iis `
  --host "example.com,www.example.com,example.net,shop.example.org" `
  --store certificatestore `
  --installation iis `
  --baseuri "your Server URL" `
  --eab-key-identifier "your EAB MAC ID" `
  --eab-key "your EAB MAC key" `
  --accepttos

3. Wildcard Certificate ​

Wildcard coverage should include:

text
example.com
*.example.com

Wildcard certificates require DNS validation. Win-ACME needs the matching DNS plugin, such as Cloudflare, Route53, or Azure DNS.

Cloudflare plugin example:

powershell
& "C:\Program Files\Win-ACME\wacs.exe" `
  --target manual `
  --host "example.com,*.example.com" `
  --validation cloudflare `
  --cloudflareapitoken "Cloudflare API Token" `
  --store certificatestore `
  --installation iis `
  --baseuri "your Server URL" `
  --eab-key-identifier "your EAB MAC ID" `
  --eab-key "your EAB MAC key" `
  --accepttos

WARNING

Win-ACME DNS plugin parameters may vary by version. Use wacs.exe --help for your installed version.

4. Confirm IIS Binding ​

Open:

text
Server Manager -> Tools -> Internet Information Services (IIS) Manager

Then:

text
Sites -> your site -> Bindings

Confirm that HTTPS on port 443 has been created.

5. Check Renewal ​

powershell
& "C:\Program Files\Win-ACME\wacs.exe" --list --baseuri "your Server URL"

For troubleshooting, add:

powershell
--verbose

6. Browser Check ​

text
https://example.com