Dynamics NAV / Business Central: automated SSL certificate

Q: Does the script restart every BC instance?

No, only the ones whose ServicesCertificateThumbprint changed. If you have multiple BC instances using the same certificate they all restart, but only because they all need updating. If you have different certificates per instance, see the advanced section below.

Q: Which account goes in --acl-fullcontrol?

The account the Business Central service runs as. Run Get-CimInstance Win32_Service -Filter "Name LIKE 'MicrosoftDynamicsNavServer%'" | Select-Object Name,StartName on the BC server and read StartName . Translate the value: simple-acme recognises only the two English names network service and administrators directly, and looks anything else up in Windows under the account's localised name. If it says NT AUTHORITY\NetworkService , write NETWORK SERVICE , not the full name - on a Danish or Swedish Windows the account is called NETVÆRKSTJENESTE, so the full English name cannot be looked up. If it says LocalSystem , write S-1-5-18 . If it says a domain account or a gMSA such as CONTOSO\svc_bc or CONTOSO\svc_bc$ , write it exactly as shown; domain names are not localised. A SID always works, for example S-1-5-20 for NETWORK SERVICE. Separate several accounts with a comma. Without that permission the instance will not start with the new certificate.

simple-acme on the BC server updates both the IIS binding for the Web Client and ServicesCertificateThumbprint in every Service Tier instance.

How it works

Install simple-acme on the BC server Extract the FairSSL edition with ImportDynamicsNAV.ps1 to C:\simple-acme and set the domain up for FairSSL AutoDNS.
Issue and deploy Run the wacs command as administrator with the BC service account in --acl-fullcontrol. The certificate is installed, bound in IIS, and ImportDynamicsNAV updates every running BC instance.
Check the IIS binding Open the BC Web Client in a browser. If the old certificate shows, the HTTPS binding is missing a host header.
Renewal The FairSSL edition has the renewal window set, so ARI drives renewal. Only instances whose certificate changed are restarted.

← All guides

Microsoft Dynamics NAV and Business Central on-premise have two certificate touchpoints that have to be updated together: the IIS binding for Web Client, and ServicesCertificateThumbprint on every BC Service Tier instance. simple-acme handles the IIS side, and FairSSL's ImportDynamicsNAV.ps1 handles the Service Tier configuration.

Supported versions

Platform	Versions	Runs on	ACME client
Dynamics NAV / Business Central	VersionsNAV 2013 R2 and newer, every Business Central version (on-premises)	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportDynamicsNAV.ps1

Setup

Step 1: Install simple-acme

Grab FairSSL's simple-acme build (pre-configured with the right ACME settings and ships ImportDynamicsNAV.ps1 in the Scripts folder). Extract to C:\simple-acme on the BC server.

Step 2: Prepare the environment

The hostname matches what BC clients connect to and is not a wildcard.
The domain is configured for FairSSL AutoDNS.
Schedule a service window - the script restarts BC instances whose thumbprint changes.
Open a command prompt as administrator and cd to C:\simple-acme.
Find the account the BC service runs as - it goes into the Step 3 command. If it says NT AUTHORITY\NetworkService, you write NETWORK SERVICE; see the FAQ on --acl-fullcontrol for the other cases. Get-CimInstance Win32_Service -Filter "Name LIKE 'MicrosoftDynamicsNavServer%'" | Select-Object Name,StartName

Step 3: Issue and deploy

Run the command as administrator. simple-acme issues the certificate via AutoDNS, installs it in the Windows Certificate Store, grants the BC service account full control of the private key, binds it in IIS and runs ImportDynamicsNAV.ps1 to update every running BC instance.

Replace NETWORK SERVICE with the account your BC service runs under. You found it in Step 2. If BC runs as NETWORK SERVICE, leave it as it is.

wacs.exe --verbose --baseuri "https://fairssl.dk/acme" `
  --eab-key-identifier YOUR_EAB_KID --eab-key YOUR_EAB_HMAC --accepttos `
  --source manual --host "bc.example.com" --validation none `
  --certificatestore My --acl-fullcontrol "NETWORK SERVICE" `
  --installation iis,script --script "Scripts\ImportDynamicsNAV.ps1" `
  --scriptparameters "'{CertThumbprint}'" `
  --friendlyname "fairssl-acme-bc.example.com"

Step 4: Verify the IIS binding

Open the BC Web Client URL in a browser and confirm the new certificate is served. If the old one is still served, the IIS binding has no host header for simple-acme to match. Open IIS Manager, go to the BC Web Client site → Bindings → HTTPS → Edit, and pick the new certificate (friendly name fairssl-acme-<host>). Add a host header to the binding while you are there (e.g. *:443:bc.example.com) so future renewals bind automatically.

Step 5: Tune the simple-acme renewal window

If you used the FairSSL simple-acme build, this is already set. Otherwise edit ScheduledTask → RenewalDays to 365 in settings.json in the simple-acme folder. That lets ARI drive renewal rather than a fixed schedule.

Advanced: multiple instances with different certificates

Only if you have multiple BC instances using different certificates. Run the Step 3 command once per certificate/instance pair and extend the script parameters with the instance name:

--scriptparameters "'{CertThumbprint}' 'BC-PROD'"

Certificates on many servers and appliances

A publicly trusted SSL certificate can be valid for at most 199 days now, 99 days by 15 March 2027 and 46 days by 15 March 2029. Each certificate then has to be replaced at least twice a year now and at least eight times a year from 2029, on every server, firewall and load balancer that uses it. sslbrain from FairSSL runs as an appliance in your own network and renews and installs the certificates from one place, including on devices without an agent.

How sslbrain renews and installs certificates on Dynamics NAV and Business Central

Frequently asked questions

Find answers to the most common questions about SSL certificates and FairSSL.

Which Dynamics NAV and Business Central versions are supported?

Dynamics NAV 2013 R2 and newer, every Business Central version (on-premises). The server must run Windows Server 2012 or newer. The ACME flow itself does not care about the BC version. ImportDynamicsNAV.ps1 finds the instances from the MicrosoftDynamicsNavServer$* Windows services and writes straight into each instance's CustomSettings.config, so it needs neither NavAdminTool nor BCAdminTool.

What does the script do at renewal?

It updates CustomSettings.config for every running BC instance so ServicesCertificateThumbprint points at the new certificate, and restarts only those instances whose thumbprint changed. Instances without a change keep running. Access to the private key is not the script's job: it comes from --acl-fullcontrol on the wacs command, which simple-acme reapplies at every renewal.

Does the script restart every BC instance?

No, only the ones whose ServicesCertificateThumbprint changed. If you have multiple BC instances using the same certificate they all restart, but only because they all need updating. If you have different certificates per instance, see the advanced section below.

Which account goes in --acl-fullcontrol?

The account the Business Central service runs as. Run Get-CimInstance Win32_Service -Filter "Name LIKE 'MicrosoftDynamicsNavServer%'" | Select-Object Name,StartName on the BC server and read StartName. Translate the value: simple-acme recognises only the two English names network service and administrators directly, and looks anything else up in Windows under the account's localised name. If it says NT AUTHORITY\NetworkService, write NETWORK SERVICE, not the full name - on a Danish or Swedish Windows the account is called NETVÆRKSTJENESTE, so the full English name cannot be looked up. If it says LocalSystem, write S-1-5-18. If it says a domain account or a gMSA such as CONTOSO\svc_bc or CONTOSO\svc_bc$, write it exactly as shown; domain names are not localised. A SID always works, for example S-1-5-20 for NETWORK SERVICE. Separate several accounts with a comma. Without that permission the instance will not start with the new certificate.

Does the certificate hostname need to match the BC client URL?

Yes. The Web Client and Service Tier endpoints must present a certificate where the common name or SAN matches what clients connect to. BC Web Client does not accept wildcards. Order a SAN certificate if you have both bc.example.com and nav.example.com.

What if the IIS binding has no host header?

simple-acme can only swap an IIS binding automatically when its host header matches the certificate. If the BC Web Client site runs on *:443: (no host header), the browser still serves the old certificate after the first run. Fix: open IIS Manager, add the host header (e.g. bc.example.com), select the new certificate manually once. Future renewals bind automatically.

Can I use the same certificate for BC Web Client and BC Service Tier?

Yes. ImportDynamicsNAV.ps1 updates the Service Tier CustomSettings.config while simple-acme also binds the certificate in IIS for the Web Client site. The same thumbprint is used both places, so renewals cover the full BC stack in one go.

Ready to automate BC certificates?

Create a free account and order your first certificate. A DV certificate is issued in under 2 minutes.

Create free account Compare certificates