If you have installed IIS on Windows Server to host your web pages written in ASP or .NET (or even PHP on IIS), you will probably want these websites to use HTTPS to make them more secure. For several years now, the Let’s Encrypt service has made it possible to generate free SSL certificates that are renewed every 90 days.
To obtain and install a certificate in IIS on Windows Server (versions 2012, 2016, 2019, and 2022), follow the steps below.
Preliminary checks
To generate the SSL certificate on the server, keep in mind that the domain must point to the server’s IP address. You can find instructions at the following link on how to configure your domain’s DNS zone with our NS. Additionally, if the domain has any aliases, they must also have a record in the DNS zone (for example, to respond to www.).
Therefore, the domain configuration in IIS must have the Bindings for these records configured (adding www is optional, but recommended):
To generate the certificate, you can use win-acme and download it from the releases page of the GitHub repository. Download the latest available version (avoid Beta versions). For example, for this article we downloaded version 2.0.10.444. Remember to use the version for Windows (do not use versions for Azure, Dreamhost, or Route53).
To run this Let’s Encrypt client, you will probably need to install .Net Framework 4.8. If you do not have it installed, see the following article: How to install .NET Framework on Windows Server 2022, 2019, 2016, and 2012
With everything in place, you can now install the Let’s Encrypt SSL certificate using ACME.
Certificate installation
First, run the executable wacs.exe as an administrator (by clicking Run as administrator):
Next, follow the instructions in the window that opens:
Select option N to create a new certificate for IIS:
Next, choose option 2. This creates a certificate for all configured IIS bindings (in this example, with and without www):
Then choose the domain for which you want to obtain the certificate (if you have more domains in IIS, you should see a longer list; this tutorial only has one domain):
Finally, select the primary domain you want to redirect to (for example, to redirect from www to the domain without www). In this case, choose option 2:
You will then be asked to enter an email address for renewal notifications. You can read the terms of use and accept them to obtain the certificate. The client will then start obtaining and configuring the certificate:
The certificate will now be configured in IIS. If you check the Bindings again, you will see that two more have been created (for www and without www), this time pointing to port 443. You can also check that the certificate has been configured correctly using this website: SSL Checker | SSLShopper
Remember that to create an HTTP-to-HTTPS redirect in IIS, you can use the URL rewrite extension, which you can download from the official website by clicking here.
Regarding certificate renewal, the WACS client automatically creates a scheduled task on the server to check the certificate or renew it if necessary every day at 9 a.m.
We hope this article has helped you. If you have any questions about this or any other issue related to your servers on Clouding, email us at soporte@clouding.io. We’re here to help! 😉