SSL Automation

Windows setup

simple-acme on Windows Server fetches and renews the certificate from FairSSL for IIS, Exchange, RDP Gateway, SQL Server and ADFS.

How it works

Get EAB keys The EAB keys are generated in the FairSSL portal under Connect ACME client.
Run simple-acme on the server Run wacs.exe with --baseuri https://fairssl.dk/acme and the EAB keys in an administrator prompt, and choose the sites to protect.
Validation and installation FairSSL AutoDNS handles domain validation, and simple-acme installs and binds the certificate.
Check and renew The setup guide in the portal shows how to check the installation. Renewal then runs automatically.

← All guides

FairSSL ACME automates certificate renewal on Windows Server. With simple-acme (formerly win-acme) you get full automation for IIS, Exchange, RDP Gateway, SQL Server and ADFS, with no manual steps after initial setup.

Supported versions

The wizard in the control panel is written for these versions. If you run an older version than the one listed, ask us before you order.

Windows

Platform	Versions	Runs on	ACME client	Guide
IIS	VersionsIIS 8 and newer	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included)	Guide →
IIS (legacy)	VersionsIIS 6.0 to 7.5, the IIS binding is set by hand	Runs onWindows Server 2008 R2 or older	ACME clientAn older simple-acme release that still runs on Windows Server 2008 R2	Guide →
Exchange Server	Versions2013, 2016, 2019 and Subscription Edition	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportExchange.v3.ps1	Guide →
Remote Desktop Services	VersionsRD Gateway (also without an RD Connection Broker), RD Web Access, RD Web Client, RD Connection Broker and the RDP listener	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportRDSFullFairSSL.ps1	Guide →
Dynamics NAV / Business Central	VersionsNAV 2013 R2 and newer, every Business Central version (on-premises)	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportDynamicsNAV.ps1	Guide →
AD FS	VersionsThe guide sets no version limit	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportADFS-WAP.v1.ps1	Guide →
Web Application Proxy	VersionsThe guide sets no version limit	Runs onWindows Server 2012 R2 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportADFS-WAP.v1.ps1	Guide →
SQL Server	VersionsThe guide sets no version limit	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportSQL.ps1	Guide →
PRTG Network Monitor	VersionsThe guide sets no version limit	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportPRTG.ps1	Guide →
Apache Tomcat	Versions8.5, 9.x, 10.x and 11.x	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportTomcat.ps1	Guide →
Other Windows service	VersionsCertificate store, PFX or PEM, with your own script	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportCustomWindows.ps1	Guide →
Several Windows servers	VersionsReceiving servers: Windows Server 2012 or newer with PowerShell 5.1 and WinRM	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + DistributeToWindowsServers.ps1	Guide →

Supported platforms

IIS 8+

Windows Server 2012+

Full automation of certificate binding, renewal and installation. Supports SNI and multiple sites.

IIS 6-7.5

Legacy (Server 2003-2008 R2)

Limited support. Certificates can be issued, but manual binding may be required. Consider upgrading.

Exchange Server →

2013, 2016, 2019 and Subscription Edition

Automatic renewal of Exchange certificates. simple-acme can install directly into the Exchange certificate store.

Remote Desktop Services →

RDP Gateway, Web Access

Automate RDP gateway certificates. Avoid the annual manual renewal that disrupts remote users.

SQL Server

TLS-encrypted connections

Certificates for encrypted SQL Server connections. simple-acme installs into the Windows certificate store.

ADFS

Active Directory Federation

Automatic renewal of ADFS service communication and token-signing certificates.

Dynamics NAV / BC →

NAV 2013 R2 and newer, every Business Central version (on-premises)

Microsoft Dynamics NAV and Business Central on-premise. simple-acme installs the certificate in Windows and updates the NAV/BC service tier configuration.

PRTG Network Monitor →

Paessler PRTG

PRTG Network Monitor. simple-acme fetches the certificate, converts it to PRTG's expected PEM/Key format and restarts the PRTG Core service.

Custom Windows service

Post-renewal scripts

Arbitrary Windows services. Use simple-acme with post-renewal scripts that export PEM/PFX and restart the service the certificate is bound to.

All Windows guides →

Recommended client: simple-acme

simple-acme (formerly win-acme) is the leading ACME client for Windows. FairSSL sponsors the project and collaborates directly with its developers.

Features

✓ Open source (Apache 2.0 licence)
✓ Interactive text interface (TUI) and CLI
✓ Supports ARI (smart renewal)
✓ Supports EAB (FairSSL account binding)
✓ Automatic Task Scheduler setup

Supported

✓ IIS certificate binding (incl. SNI)
✓ Windows Certificate Store
✓ PEM/PFX file export
✓ Exchange, RDP, ADFS installation
✓ Post-install scripts (PowerShell)

Important: Adjust Settings.json

Extract simple-acme to e.g. C:\simple-acme. Open Settings.json and set RenewalDays to 365 and RenewalMinimumValidDays to 15. With ARI, simple-acme will automatically renew at the optimal time, but these values ensure renewal always happens with at least 15 days of margin.

simple-acme

# Run in an administrator command prompt

wacs.exe --baseuri "https://fairssl.dk/acme" --verbose ^
  --eab-key-identifier dhgbKR8K73PgqAxIij6CDg ^
  --eab-key QAx4jKmABqeYCXGZ1H7-eqG2qkPCtflHo5r51TWpebs ^
  --accepttos

simple-acme will interactively ask which sites you want to protect. Domain validation is handled automatically via FairSSL AutoDNS. EAB keys are generated in the FairSSL portal under "Connect ACME client".

Posh-ACME (PowerShell)

# Install the Posh-ACME module and create an account

Set-PAServer -DirectoryUrl 'https://fairssl.dk/acme'

New-PAAccount `
  -ExtAcctKID 'dhgbKR8K73PgqAxIij6CDg' `
  -ExtAcctHMACKey 'QAx4jKmABqeYCXGZ1H7-eqG2qkPCtflHo5r51TWpebs' `
  -AcceptTOS

New-PACertificate 'www.your-domain.com','your-domain.com' `
  -DirectoryUrl 'https://fairssl.dk/acme' `
  -Plugin Manual `
  -PluginArgs @{ManualNonInteractive = $true}

Remember to create a daily task in Task Scheduler to run Submit-Renewal for automatic renewal.

Guided setup in the FairSSL portal

The FairSSL customer portal has an interactive setup wizard that generates a complete installation guide tailored to your server. You do not need to be an ACME expert to set it up.

Choose platform and server type

Windows or Linux, then server type (IIS 8+, Exchange, RDP, SQL Server, ADFS and more)

Enter domain names

Specify common name and any SAN domains (e.g. www.example.com, example.com)

Receive a tailored guide

The portal generates a step-by-step guide with the exact command for your server, including your EAB keys and domain names

Example: Generated command for IIS 8+ with automatic binding

wacs.exe --verbose ^
  --baseuri "https://fairssl.dk/acme" ^
  --eab-key-identifier YOUR_EAB_KID ^
  --eab-key YOUR_EAB_HMAC ^
  --accepttos ^
  --source manual ^
  --host "www.example.com,example.com" ^
  --friendlyname "fairssl-acme-www.example.com" ^
  --store certificatestore --certificatestore My ^
  --validation none ^
  --installation iis

EAB keys, domain names and friendly name are filled in automatically with your values. Domain validation is handled via FairSSL AutoDNS.

Verify and adjust configuration

The guide includes tips for verifying that the certificate is correctly installed, and recommended settings for automatic renewal

Start setup

Certificates on many servers and appliances

A publicly trusted SSL certificate can be valid for at most 199 days now, 99 days by 15 March 2027 and 46 days by 15 March 2029. Each certificate then has to be replaced at least twice a year now and at least eight times a year from 2029, on every server, firewall and load balancer that uses it. sslbrain from FairSSL runs as an appliance in your own network and renews and installs the certificates from one place, including on devices without an agent.

How to connect Windows servers to sslbrain

Questions about Windows setup

Find answers to the most common questions about SSL certificates and FairSSL.

Does simple-acme work with load balancers?

Yes. FairSSL AutoDNS handles all domain validation automatically, so there are no dependencies on port 80 or routing of challenge requests. It works behind load balancers, firewalls and reverse proxies without extra configuration.

Can I use simple-acme on Windows Server 2008/2008 R2?

Only with an older simple-acme release. The current FairSSL edition of simple-acme is built on .NET 10 and needs Windows Server 2012 or newer. For IIS 6.0 to 7.5 on Server 2008 R2 or older, the guide in the control panel uses an older simple-acme release and you set the IIS binding yourself. Server 2008 is end-of-life and does not support TLS 1.2 without manual patches, so we recommend upgrading to Server 2016 or newer.

What about Certify The Web as an alternative?

Certify The Web is a graphical Windows ACME client with good IIS integration. It works with the FairSSL ACME server: just enter our directory URL. We recommend simple-acme because it is open source, CLI-friendly and supports more server types.

Ready for automated SSL on Windows?

Create a free account and order your first certificate. A DV certificate is issued in under 2 minutes.

Create free account Compare certificates