IIS (Internet Information Services) doesn’t include a Let’s Encrypt client, but the free tool win-acme makes free, auto-renewing HTTPS certificates easy. This guide covers getting certificates, binding them to sites, redirecting HTTP to HTTPS, and hardening TLS.

New to IIS? Start with install IIS on Windows Server.

Prerequisites

  • An IIS site with an HTTP binding for your domain (example.com and www.example.com).
  • DNS A records pointing to the server. See point a domain to a VPS.
  • Ports 80 and 443 open in Windows Firewall:
New-NetFirewallRule -DisplayName "HTTP" -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow
New-NetFirewallRule -DisplayName "HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow

Let’s Encrypt validates via HTTP on port 80 (or DNS for wildcards), so port 80 must be reachable.

Get a certificate with win-acme

  1. Download win-acme from its official site, and extract it, for example to C:\Tools\win-acme.
  2. Run wacs.exe as Administrator.
  3. Choose N: Create certificate (default settings).
  4. Pick your IIS site, and select the host names (bindings) to include.
  5. Accept the terms, and enter your email for expiry notices.

win-acme:

  • validates the domain over HTTP;
  • installs the certificate into the Windows certificate store;
  • adds or updates the HTTPS (443) binding with SNI;
  • creates a scheduled task that renews certificates automatically (Let’s Encrypt certificates last 90 days).

Check the task in Task Scheduler (win-acme renew …). Renewals run daily, and renew about 30 days before expiry.

Wildcard certificates (*.example.com) need DNS validation. win-acme supports many DNS providers through plugins, or manual TXT records.

Bindings and SNI

With several HTTPS sites on one IP, each binding must have “Require Server Name Indication” enabled (win-acme sets this). Check in IIS Manager → Site → Bindings, or with PowerShell:

Get-WebBinding -Protocol https

Redirect HTTP to HTTPS

Install the free URL Rewrite module from Microsoft, then add a rule to the site’s web.config:

<configuration>
  <system.webServer>
    <rewrite>
      <rules>
        <rule name="HTTPS redirect" stopProcessing="true">
          <match url="(.*)" />
          <conditions>
            <add input="{HTTPS}" pattern="off" />
            <add input="{REQUEST_URI}" pattern="^/\.well-known/acme-challenge/" negate="true" />
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
        </rule>
      </rules>
    </rewrite>
  </system.webServer>
</configuration>

The ACME challenge exclusion keeps renewals working. Keep the HTTP binding in place, because the redirect needs it. See IIS URL Rewrite and reverse proxy.

HSTS

IIS 10 (Windows Server 2019+) supports HSTS per site: IIS Manager → Site → HSTS → enable, with max-age 31536000. Or add the header in web.config:

<httpProtocol>
  <customHeaders>
    <add name="Strict-Transport-Security" value="max-age=31536000" />
  </customHeaders>
</httpProtocol>

Only enable HSTS once HTTPS works on every subdomain you include.

TLS protocols and ciphers

  • Windows Server 2022 and 2025 support TLS 1.3, and enable it by default. Windows Server 2019 supports up to TLS 1.2. See Windows Server 2019 vs 2022.
  • Disable old protocols (SSL 3.0, TLS 1.0/1.1) and weak ciphers. IIS Crypto (a free GUI tool) applies best-practice templates. A reboot is required.
  • Test with an online SSL checker.

Troubleshooting

Problem Fix
Validation fails Port 80 blocked, DNS not pointing here, or a redirect breaks /.well-known/
Wrong certificate shown Missing SNI on bindings, or a binding with an old certificate
Renewal stopped Check the win-acme scheduled task, and its logs in %ProgramData%\win-acme
Mixed content warnings Update http:// URLs in the app to https://

Quick reference

Task Tool
Free certificates win-acme (wacs.exe, as Administrator)
Renewal win-acme scheduled task
Multiple HTTPS sites SNI on each binding
HTTP → HTTPS URL Rewrite rule
TLS hardening IIS Crypto

Related: host ASP.NET on IIS and Windows VPS.

  • IIS
  • SSL
  • Windows Server