> ## Documentation Index > Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt > Use this file to discover all available pages before exploring further. # How to Get a Free Let's Encrypt SSL Certificate on IIS (win-acme) > Get a free Let's Encrypt SSL certificate on IIS with win-acme: run wacs.exe as admin, choose N, pick your site, and win-acme adds the HTTPS binding and auto-renewal. To get a free Let's Encrypt certificate on IIS, download win-acme from [win-acme.com](https://www.win-acme.com/), unzip it to `C:\Program Files\win-acme`, run `wacs.exe` as administrator and choose **N** (create a certificate with default settings). Pick your IIS site, enter your email and accept the terms. win-acme validates the domain over port 80, installs the certificate, adds the HTTPS binding on port 443 and creates a scheduled task that renews it automatically. | Difficulty | Time | Works on | Needs | | - | - | - | - | | Beginner | 10 minutes | Windows Server 2019 / 2022 / 2025 with IIS | A domain pointing at the server, port 80 open | ## Before you start * [Install IIS](https://help.freakhosting.com/portals/other/how-to-install-iis-on-windows-server.md) and create a site with a **host name binding** for your domain, for example `example.com` and `www.example.com`. win-acme reads the domain names from these bindings. * Your domain's `A` record must point to the server's IP (for example `203.0.113.10`). Check from your own computer that `http://example.com` shows your site. * Port **80** must be open from the internet, in Windows Firewall and in any external firewall such as the [Firewall panel](https://help.freakhosting.com/portals/firewall/firewall-panel-overview.md). Let's Encrypt's HTTP-01 check only works on port 80 ([Let's Encrypt](https://letsencrypt.org/docs/challenge-types/)). Port **443** must be open for HTTPS visitors. * Sign in as an administrator with [Remote Desktop](https://help.freakhosting.com/portals/other/how-to-connect-to-windows-server-with-remote-desktop.md). ## What are win-acme and Let's Encrypt? **Let's Encrypt** is a free certificate authority. Its certificates are currently valid for up to 90 days. **win-acme** (`wacs.exe`) is a free, open-source Windows client that requests those certificates, installs them in IIS and renews them before they expire. ## How to download win-acme **1. Download the zip** On the server, open [win-acme.com](https://www.win-acme.com/) and download the current release. For most servers the recommended file is the **x64 trimmed** build (`win-acme.v2.x.x.xxxx.x64.trimmed.zip`). **2. Unzip to a permanent folder** Unzip it to `C:\Program Files\win-acme`. Don't run it from **Downloads** or a temporary folder: the renewal task runs `wacs.exe` from this location later ([win-acme getting started](https://www.win-acme.com/manual/getting-started)). If Windows blocks the files because they came from the internet, right-click the zip, choose **Properties**, tick **Unblock** and select **OK** before you unzip it. ## How to create the certificate **1. Run wacs.exe as administrator** Open `C:\Program Files\win-acme`, right-click `wacs.exe` and choose **Run as administrator**. win-acme needs administrator rights. **2. Choose N** In the main menu, type `N` (create a certificate with default settings) and press **Enter**. The default settings are for a normal certificate on a local IIS site. **3. Pick the site** win-acme takes the domain names from the bindings of an IIS site (you can also type them in by hand). Choose your site, for example the one for `example.com`, by typing the number shown next to it. **4. Choose the domain names** Confirm the host names to include, for example `example.com` and `www.example.com`. Every name must point to this server. **5. Register with Let's Encrypt (first run only)** win-acme creates an account with Let's Encrypt the first time. Accept the terms of service and enter an email address such as `you@example.com`, which Let's Encrypt can use to contact you. **6. Let it validate and install** win-acme proves you control the domain with an HTTP check on port 80, downloads the certificate, adds or updates the `https` binding on port 443 for your site, and creates the renewal task. Read the output: each step should end without a red error. **7. Close win-acme** Leave the menu (the quit option is listed at the bottom) or close the window. ## How to check it worked 1. Browse to `https://example.com`. The padlock shows a certificate issued by Let's Encrypt. 2. In IIS Manager (`inetmgr`), select your site and choose **Bindings**. There is an `https` binding on port `443` with your host name. 3. Open **Task Scheduler** and look in **Task Scheduler Library**: win-acme created a renewal task after the first certificate. Don't rename it. ## How does renewal work? win-acme's scheduled task runs every day at 9:00 by default under the `SYSTEM` account ([win-acme automatic renewal](https://www.win-acme.com/manual/automatic-renewal)) and renews a certificate once it is 55 days old by default, or earlier if Let's Encrypt suggests it. That leaves plenty of time before the 90-day expiry ([win-acme settings](https://www.win-acme.com/reference/settings)). Your choices from the first run are reused for each renewal, so nothing else is needed. To test a renewal now, open an admin PowerShell window in the win-acme folder and force one: ```powershell theme={null} cd "C:\Program Files\win-acme" .\wacs.exe --renew --force ``` To see or edit your renewals, run `wacs.exe` and open **Manage renewals** in the menu. > [!WARNING] > > Renewals fail if port 80 gets closed, the domain stops pointing at the server, or you delete or move the win-acme folder. If you change any of these, run a renewal by hand afterwards to check it still works. ## How to redirect HTTP to HTTPS IIS doesn't redirect to HTTPS on its own. After the certificate works, the simplest options are your application's own setting (for example WordPress or ASP.NET), or the **URL Rewrite** module for IIS with a redirect rule. Keep the `http` binding on port 80: Let's Encrypt needs it to validate renewals. ## Frequently asked questions ### Can I get a wildcard certificate (\*.example.com)? Not with the default settings. Wildcard certificates need DNS validation (DNS-01), because HTTP validation can't issue them. win-acme supports DNS validation through the full options in the main menu (`M`). ### Which Windows Server versions does win-acme support? The current win-acme release runs on .NET, which Microsoft supports on Windows Server 2016 and later, so Windows Server 2019, 2022 and 2025 all work ([win-acme system requirements](https://www.win-acme.com/manual/system-requirements)). ### Do I need to restart IIS after installing the certificate? No. win-acme updates the binding in IIS directly. ### Validation fails. What should I check? Check that `http://example.com` loads your site from outside your server, that the `A` record points to the correct IP, and that nothing redirects port 80 traffic to another server. Then run win-acme again. ## Related guides > [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md) > > Every guide in this section. > [card] [Install IIS](https://help.freakhosting.com/portals/other/how-to-install-iis-on-windows-server.md) > > Set up the site first. > [card] [Open a port in Windows Firewall](https://help.freakhosting.com/portals/other/how-to-open-a-port-in-windows-firewall.md) > > Allow ports 80 and 443. > [card] [Check if a port is open from outside](https://help.freakhosting.com/portals/other/how-to-check-if-a-port-is-open-from-outside.md) > > Test port 80 before validating. > [card] [Free SSL with Certbot (Linux)](https://help.freakhosting.com/portals/other/how-to-get-a-free-ssl-certificate-with-certbot.md) > > The Linux equivalent. *** > [!NOTE] > > **Checked against the official [win-acme documentation](https://www.win-acme.com/manual/getting-started) ([settings](https://www.win-acme.com/reference/settings), [system requirements](https://www.win-acme.com/manual/system-requirements)) and [Let's Encrypt challenge types](https://letsencrypt.org/docs/challenge-types/)** on 4 November 2026 (win-acme 2.2.9). Not tested on a live Windows server for this page; menu wording can change between win-acme releases. > [!NOTE] > > ### Need Extra Help? > > If you encounter any issues, our support team is ready to assist: > > * **Live Chat:** Quick assistance via our website. > * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php) > * **Discord:** [Join our Community](https://discord.gg/freakhosting) > * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com) > [!TIP] > > ### Save on Your Hosting > > Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order! *** **Last Updated:** November 2026 This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.