Set up once. Renew automatically.

Automatic renewal for Windows / IIS

Set up a native certificate client on your server once. On a compatible configuration, it obtains replacements and installs them before expiry. You should not have to download and reinstall a certificate every few months.

Why shorter certificates improve security

A shorter lifetime limits the window in which a stolen private key or incorrectly issued certificate can be misused. Automatic renewal makes frequent replacement practical and reduces repeated manual key handling. It does not repair a compromised server: exposed keys still need prompt revocation/replacement and investigation.

Your annual RymarisCerts plan covers management and guidance across renewals. It does not make one certificate valid for a year. Use the actual expiry and renewal schedule, not your billing anniversary. Read the certificate authority's security rationale.

Compatibility comes first

Lab configuration: Windows Server 2025 / IIS 10 · simple-acme / WACS 2.4.1.

• You need administrator access, the intended site's configuration and a protected rollback.
• Public DNS and HTTP port 80 must reach the correct server for this HTTP-01 path. Check IPv6 and any proxy/CDN too.
• Managed hosting, wildcard DNS/API automation, other versions and unusual network layouts require a separate compatibility check. This is not a guarantee for every server.

Download the read-only compatibility check. The check reports local prerequisites; only real validation and a verified installation prove setup succeeded.

This lab configuration passed initial enrollment, the native scheduled renewal action, verification of the changed served certificate, and controlled failure/recovery checks. Disposable test certificates were used. Your own public DNS, trust and installation must still pass.

Watch automatic renewal and installation

This is a real scripted server session. Silent waiting periods have been shortened; all shown operations were executed. The isolated lab cannot update the public-suffix list, and its disposable task is disabled between demonstrations. The test enables and executes the task; keep your production client updated and its scheduled task enabled.

Actual scripted lab session, silent with English captions. Pause or use full screen to read commands. The lab uses a private ACME test server and short test lifetimes to demonstrate real replacement. Production uses your chosen publicly trusted provider; never copy a lab root or bypass TLS warnings.

Read the automatic-renewal transcript

Jump to a chapter

1. 00:00 Security: short lifetimes with automatic replacement
2. 00:04 Check the supported server and back up configuration
3. 00:09 Enroll the native client and IIS installer once
4. 00:23 Verify the certificate actually served
5. 00:28 Inspect and execute the native scheduled renewal
6. 00:47 Confirm scheduled replacement is installed
7. 00:51 Prove failure preserves the working certificate
8. 01:07 Restore connectivity and verify recovery

Chapters are ready when video metadata loads.

One-time setup

1. Confirm administrator access, an existing IIS site and its exact hostnames. Run the read-only compatibility check. Back up IIS configuration and the working certificate. Keep a recovery path before making any change.

2. Download the official Windows ACME client and verify the release checksum. Keep it in a permanent restricted tools directory. Our lab uses WACS / simple-acme 2.4.1; other client/server combinations require a compatibility check.

3. Run the client as administrator with the explicit Let's Encrypt endpoint below. Review the provider terms and contact address. Select only the intended IIS site and hostnames, HTTP filesystem validation, certificate-store storage and IIS installation. Allow its standard scheduled task. Preserve other sites and bindings.

4. Complete the initial domain validation. For this supported HTTP-01 path, public A/AAAA records must reach the intended server on port 80 and the challenge path must be accessible without login. A successful order must also install the certificate into the exact HTTPS/SNI bindings.

5. Open every intended HTTPS hostname from another device using normal public trust. Check the website, SAN names, expiry and served SHA-256 fingerprint. Check the other sites still work. The client keeps the renewal key on your server.

6. Check the native renewal task in Task Scheduler: executable in the permanent directory, correct account/permissions, next run and task result. Launch it once to confirm it runs. A fresh production certificate can correctly report not due; do not repeatedly force production orders to test.

7. Review the client's logs/Event Viewer and arrange failure monitoring. When renewal is due, the client obtains a replacement and updates the configured IIS bindings. A successful download or task launch alone does not prove the new certificate is being served.

8. Keep Windows and the client supported and updated. Recheck the setup after site, firewall, DNS or permission changes. If renewal fails, investigate before expiry and use the protected manual-installation fallback or request a separate quote.

Commands for your own supported server

Replace example.com with your actual hostname. Add www or other names only when their DNS and site bindings are ready. Keep an existing backup and review the provider's terms when prompted.

# Administrator PowerShell; keep the extracted client in a permanent directory.
# Select only your intended IIS site in the interactive setup.
.\wacs.exe --baseuri https://acme-v02.api.letsencrypt.org/directory

# Verify your real hostname from another device, without ignoring TLS warnings.
curl.exe -I https://example.com/

Where your private key lives

The native client talks directly to the certificate authority and keeps its renewal credentials and private keys on your server. RymarisCerts does not need your server password or DNS API credentials for this HTTP-01 path. Back up that server's client configuration securely.

Your dashboard can check and save the public certificate your website serves. It cannot export the private key of a certificate created only by your native client. Protected PFX/PEM downloads remain available for certificates issued through the portal's manual workflow.

If automation fails

Check the native task/timer, client logs, DNS, HTTP challenge path, permissions and configuration tests before expiry. A successful order or scheduler launch alone does not prove installation. Verify the live certificate after recovery. Keep the working configuration while investigating and avoid repeatedly forcing public orders.

Manual Windows / IIS installation and format fallback · Request separately quoted setup help · Renewal checklist

Official references

• https://simple-acme.com/manual/automatic-renewal
• https://simple-acme.com/reference/plugins/installation/iis
• https://simple-acme.com/reference/plugins/validation/http/filesystem

All server guides · FAQs · Your certificates