C:\Program Files\win-acme, run wacs.exe as administrator and choose N (create a certificate with default settings). Pick your IIS site, enter your email and accept the terms. win-acme validates the domain over port 80, installs the certificate, adds the HTTPS binding on port 443 and creates a scheduled task that renews it automatically.
Before you start
- Install IIS and create a site with a host name binding for your domain, for example
example.comandwww.example.com. win-acme reads the domain names from these bindings. - Your domain’s
Arecord must point to the server’s IP (for example203.0.113.10). Check from your own computer thathttp://example.comshows your site. - Port 80 must be open from the internet, in Windows Firewall and in any external firewall such as the Firewall panel. Let’s Encrypt’s HTTP-01 check only works on port 80 (Let’s Encrypt). Port 443 must be open for HTTPS visitors.
- Sign in as an administrator with Remote Desktop.
What are win-acme and Let’s Encrypt?
Let’s Encrypt is a free certificate authority. Its certificates are currently valid for up to 90 days. win-acme (wacs.exe) is a free, open-source Windows client that requests those certificates, installs them in IIS and renews them before they expire.
How to download win-acme
1
Download the zip
On the server, open win-acme.com and download the current release. For most servers the recommended file is the x64 trimmed build (
win-acme.v2.x.x.xxxx.x64.trimmed.zip).2
Unzip to a permanent folder
Unzip it to
C:\Program Files\win-acme. Don’t run it from Downloads or a temporary folder: the renewal task runs wacs.exe from this location later (win-acme getting started).How to create the certificate
1
Run wacs.exe as administrator
Open
C:\Program Files\win-acme, right-click wacs.exe and choose Run as administrator. win-acme needs administrator rights.2
Choose N
In the main menu, type
N (create a certificate with default settings) and press Enter. The default settings are for a normal certificate on a local IIS site.3
Pick the site
win-acme takes the domain names from the bindings of an IIS site (you can also type them in by hand). Choose your site, for example the one for
example.com, by typing the number shown next to it.4
Choose the domain names
Confirm the host names to include, for example
example.com and www.example.com. Every name must point to this server.5
Register with Let's Encrypt (first run only)
win-acme creates an account with Let’s Encrypt the first time. Accept the terms of service and enter an email address such as
you@example.com, which Let’s Encrypt can use to contact you.6
Let it validate and install
win-acme proves you control the domain with an HTTP check on port 80, downloads the certificate, adds or updates the
https binding on port 443 for your site, and creates the renewal task. Read the output: each step should end without a red error.7
Close win-acme
Leave the menu (the quit option is listed at the bottom) or close the window.
How to check it worked
- Browse to
https://example.com. The padlock shows a certificate issued by Let’s Encrypt. - In IIS Manager (
inetmgr), select your site and choose Bindings. There is anhttpsbinding on port443with your host name. - Open Task Scheduler and look in Task Scheduler Library: win-acme created a renewal task after the first certificate. Don’t rename it.
How does renewal work?
win-acme’s scheduled task runs every day at 9:00 by default under theSYSTEM account (win-acme automatic renewal) and renews a certificate once it is 55 days old by default, or earlier if Let’s Encrypt suggests it. That leaves plenty of time before the 90-day expiry (win-acme settings). Your choices from the first run are reused for each renewal, so nothing else is needed.
To test a renewal now, open an admin PowerShell window in the win-acme folder and force one:
wacs.exe and open Manage renewals in the menu.
How to redirect HTTP to HTTPS
IIS doesn’t redirect to HTTPS on its own. After the certificate works, the simplest options are your application’s own setting (for example WordPress or ASP.NET), or the URL Rewrite module for IIS with a redirect rule. Keep thehttp binding on port 80: Let’s Encrypt needs it to validate renewals.
Frequently asked questions
Can I get a wildcard certificate (*.example.com)?
Not with the default settings. Wildcard certificates need DNS validation (DNS-01), because HTTP validation can’t issue them. win-acme supports DNS validation through the full options in the main menu (M).
Which Windows Server versions does win-acme support?
The current win-acme release runs on .NET, which Microsoft supports on Windows Server 2016 and later, so Windows Server 2019, 2022 and 2025 all work (win-acme system requirements).Do I need to restart IIS after installing the certificate?
No. win-acme updates the binding in IIS directly.Validation fails. What should I check?
Check thathttp://example.com loads your site from outside your server, that the A record points to the correct IP, and that nothing redirects port 80 traffic to another server. Then run win-acme again.
Related guides
VPS and dedicated server guides
Every guide in this section.
Install IIS
Set up the site first.
Open a port in Windows Firewall
Allow ports 80 and 443.
Check if a port is open from outside
Test port 80 before validating.
Free SSL with Certbot (Linux)
The Linux equivalent.
Checked against the official win-acme documentation (settings, system requirements) and Let’s Encrypt challenge types on 4 November 2026 (win-acme 2.2.9). Not tested on a live Windows server for this page; menu wording can change between win-acme releases.
Need Extra Help?
If you encounter any issues, our support team is ready to assist:- Live Chat: Quick assistance via our website.
- Support Ticket: Open a Ticket
- Discord: Join our Community
- Email: support@freakhosting.com
Last Updated: November 2026