DE

Home / Acmefyer / IIS certificate

AcmefyerAgent-based Certificate Manager

Renew IIS certificates automatically, with Let’s Encrypt.

The same on every Windows Server with IIS: obtain the certificate, import it as a PFX, switch the HTTPS binding, and that on every server. Acmefyer obtains the certificate via ACME, for example for free from Let’s Encrypt, and an agent on the IIS server installs it and binds it to the site.

Explore Acmefyer Documentation
01By handWhat every replacement involves

How to replace the SSL certificate in IIS by hand.

The new certificate goes into the computer’s certificate store as a PFX file, for example with PowerShell:

Import-PfxCertificate -FilePath C:\certs\www.pfx -CertStoreLocation Cert:\LocalMachine\My -Password (Read-Host -AsSecureString)

Then select the site in IIS Manager, open Bindings, edit the HTTPS binding and pick the new certificate. If several sites share an IP address, each binding needs its host name and Require Server Name Indication (SNI).

Every server
Import and binding repeat on every IIS server and for every site.
Validation
For HTTP-01 the certificate authority must be able to fetch a file under /.well-known/acme-challenge/ on port 80, without a broken redirect.
Remote access
Scripts that do this centrally need WinRM or file shares on every server and administrator passwords in one place.
How often
Since March 2026 public certificates are valid for at most 200 days, from 2029 for only 47 days. The replacement is then due roughly every month.
02With AcmefyerWhat the agent takes care of

One agent per IIS server, one certificate for many.

The Acmefyer server obtains the certificate from Let’s Encrypt or another ACME certificate authority and renews it 30 days before expiry. The Acmefyer agent runs as a service on every IIS server. It picks up the new certificate, imports it into the Windows certificate store and switches the site’s binding.

The same certificate can go to many targets: several IIS servers behind a load balancer, plus Exchange, a FortiGate or NGINX. The IIS server needs no open port and no internet access for this.

IIS
Import the certificate into the Windows certificate store and bind it to the selected site, with host name and port.
Detection
The agent finds the IIS sites with their bindings and the certificate currently in place and suggests the matching deployment. It leaves out IIS on an SCCM server, the web enrollment of an internal PKI and bindings to the central certificate store.
Validation
HTTP-01 through IIS itself: the agent places the validation file in the site’s folder. Without access from the outside it works via DNS-01.
HTTP.sys
For Windows applications that serve HTTPS through HTTP.sys without IIS, such as Reporting Services: switch the port’s binding, verify and roll back otherwise.
Certificate store
Install into a store without a binding, for example for Remote Desktop or SQL Server.
03SetupSet up once, then it runs on its own
  1. 01

    Add a domain

    For example www.example.com, with Let’s Encrypt and validation via HTTP-01 or DNS-01.

  2. 02

    Install the agent

    Run the setup package on the IIS server, or distribute it with PDQ Deploy or other software distribution.

  3. 03

    Create the deployment

    The agent shows the detected sites. One click creates the deployment.

  4. 04

    Done

    From now on Acmefyer renews the certificate in time and reports every result.

04FAQFrequently asked questions about IIS certificates

Does Let’s Encrypt work with IIS?

Yes. IIS takes any certificate from the Windows certificate store. Let’s Encrypt issues it for free via ACME, and Acmefyer installs it and binds it to the site.

Does Acmefyer have to run on the IIS server?

No. The Acmefyer server runs on a separate Windows or Linux server. Only the small agent runs as a service on the IIS server. It connects outbound to the Acmefyer server.

Which Windows Server versions are supported?

The agent runs on Windows x64, ARM64 and 32-bit and installs itself as a Windows service. It serves IIS and the system’s HTTP.sys bindings.

My IIS server cannot be reached from the outside. Does it still work?

Yes, with DNS-01. Acmefyer creates the validation record at your DNS provider; the IIS server neither has to be reachable from the internet nor reach the internet itself. This also covers internal servers with a public name.

Can I use one certificate for several IIS sites?

Yes. A certificate can contain several names or be a wildcard certificate. You create one deployment per site and server; after every renewal Acmefyer installs it everywhere again.