Example: Win-ACME with IIS using HTTP-01 Domain Validation

Windows Server / IIS — This guide walks through configuring Win-ACME to request and install a certificate using HTTP-01 validation and your GeoCerts ACME Directory URL.

GeoCerts recommends the DigiCert ACME Client for new deployments. Use this page if you already rely on Win-ACME. For the DAC walkthrough on the same stack, see IIS with HTTP-01 (Windows).

Acronyms used on this guide

Term Meaning
ACME Automated Certificate Management Environment — the protocol used to automate certificate issuance and renewal
ADU ACME Directory URL — the endpoint and credential profile you create in CertCommand under Automation > ACME Directory URLs
EAB External Account Binding — Key ID and HMAC credentials that authenticate your ACME client to GeoCerts
DCV Domain Control Validation — proof that you control a domain name (via a DNS-01 or HTTP-01 challenge)
MPIC Multi-Perspective Issuance Correlation — DigiCert validates DCV from multiple global network locations See SSL Domain Validation (DCV) Rules Have Changed.
DAC DigiCert ACME Client — GeoCerts' recommended ACME client (`dc-acme`)
ARI ACME Renewal Information — optional CA-directed schedule for when to renew a certificate

Command environment: Run Win-ACME from an elevated PowerShell session (Run as Administrator).

Prerequisites

Before you begin, make sure you have:

  • An ACME Directory URL with its EAB Key ID and EAB HMAC Key—sandbox or production (sandbox is fine for experimentation).
  • Windows Server with IIS installed and a site listening on port 80 for the hostname you are securing.
  • The domain’s A record points at this host and port 80 is publicly reachable from multiple regions worldwide under MPIC requirements.
  • Win-ACME v2.2.9+ (Pluggable release preferred).

Step 1: Download Win-ACME

Download the latest Pluggable release from the Win-ACME documentation site and unzip it—for example:

C:\Tools\win-acme\

Step 2: Launch Win-ACME with DigiCert ACME Directory URL

Open PowerShell as Administrator, change to the Win-ACME directory, and run:

# Launch Win-ACME with DigiCert ACME Directory URL
.\wacs.exe --baseuri "https://one.digicert.com/mpki/api/v1/acme/v2/directory"

At the interactive menu, choose:

M: Create certificate (full options)

Step 3: Choose Domain Source

Select how Win-ACME discovers hostnames:

1: Read bindings from IIS

Win-ACME scans IIS and lists bindings it finds—for example:

Found binding: shop.example.com

Select the hostnames to include. Ensure each name resolves publicly to this server.

When prompted to split the source into multiple certificates, choose 4: Single certificate for most environments unless you have a specific reason to split.

Step 4: Validation Method

Choose:

2: [http] Serve verification files from memory

Win-ACME temporarily serves the .well-known/acme-challenge token from memory. Port 80 must be reachable from the internet.

Step 5: Choose Key Type

When prompted for CSR key type:

1: Elliptic Curve key
2: RSA key

Choose 2: RSA key unless you have a specific need for EC keys. RSA is the safe default for IIS.

Step 6: Choose Certificate Store Location

When asked where to store the issued certificate:

1: IIS Central Certificate Store (.pfx per host)
2: PEM encoded files (Apache, nginx, etc.)
3: PFX archive
4: Windows Certificate Store (Local Computer)
5: No (additional) store steps

Choose 4: Windows Certificate Store (Local Computer) for typical IIS deployments.

Win-ACME then asks which store:

1: [WebHosting] - Dedicated store for IIS
2: [My] - General computer store (for Exchange/RDS)
3: [Default] - Use global default, currently WebHosting

Select 3: [Default] unless you use a dedicated store.

For additional storage, choose 5: No (additional) store steps.

Step 7: Installation

Select:

1: Create or update IIS bindings

Win-ACME binds the issued certificate to your IIS site.

Step 8: ACME Account and EAB Credentials

When prompted to create an ACME account, enter your External Account Binding Key ID and HMAC Key from CertCommand.

Step 9: Complete the Order

Win-ACME will:

  • Create your ACME account (if needed)
  • Validate the domain via HTTP-01
  • Request the certificate
  • Install it to the Windows Certificate Store
  • Bind it to your IIS site

Sample output:

[INFO] Authorizing identifier shop.example.com using http-01
[INFO] Answer should now be browsable at http://shop.example.com/.well-known/acme-challenge/xyz...
[INFO] Authorization result: valid
[INFO] Requesting certificate shop.example.com
[INFO] Store with CertificateStore
[INFO] Installing with IIS
[INFO] Adding new https binding shop.example.com:443
[INFO] Installation step complete
[INFO] Adding renewal for shop.example.com
[INFO] Renewal added

Authorization result: valid
Order status: valid
Certificate installed successfully

Confirm the order in CertCommand under Certificates > Orders.

Step 10: Test HTTPS

Browse to https://yourdomain.com and confirm:

  • HTTPS loads without errors
  • The certificate issuer is DigiCert, GeoTrust, or Thawte

You can also use the GeoCerts SSL Checker.

Step 11: Automatic Renewals

Win-ACME adds a scheduled task for renewals. Check it:

# List Win-ACME renewal scheduled task
schtasks /Query /TN "win-acme renewals"

To renew manually:

# Run renewal manually (uses saved renewal configuration)
.\wacs.exe --renew --baseuri "https://one.digicert.com/mpki/api/v1/acme/v2/directory"

Troubleshooting

Common issues:

  1. Port 80 blocked — HTTP-01 requires public reachability on port 80 from multiple regions (MPIC).
  2. Wrong ACME server — Confirm --baseuri points at your DigiCert directory URL, not Let’s Encrypt.
  3. DNS — The hostname must resolve to this server’s public IP.
  4. IIS bindings — The site must listen on port 80 for the hostname being validated.

For EAB, DCV, and installation diagnosis patterns (applicable across clients), see Verify and Diagnose ACME Requests. For unexpected new orders on renewal, see Troubleshooting — Unexpected new orders.

← Back to Alternative ACME Clients