Free SSL on IIS with Let's Encrypt and win-acme

In short

You can install a free Let's Encrypt SSL certificate on IIS by using win-acme on a Raff Windows VPS. The clean workflow is: confirm IIS is installed, make sure the IIS site has a real hostname binding, point DNS to the VPS, open ports 80 and 443, run win-acme, let it create the HTTPS binding, and verify the automatic renewal task. Do not start with certificate issuance. Start with IIS, DNS, and firewall.

Quick verdict

The certificate setup is usually simple, but only after DNS, firewall, and IIS bindings are correct.

What we tested on Raff

We tested the IIS and win-acme preparation workflow on a Raff Windows VPS running Windows Server with IIS installed.

Test environment:

In the lab, we verified:

• IIS installed and running
• IIS bindings visible from PowerShell
• Windows Firewall rules for HTTP and HTTPS
• win-acme downloaded and running
• win-acme connection to Let's Encrypt
• the expected certificate creation and IIS binding flow

Some certificate creation screenshots in this guide are illustrative examples. In production, use your real hostname and verify DNS before requesting a certificate.

What you'll need

• A Raff Windows VPS with Windows Server 2022 or Windows Server 2025
• Local administrator access over RDP
• IIS installed with at least one working site
• A public domain or subdomain, such as app.example.com
• DNS access for that domain
• TCP 80 and TCP 443 open in Windows Firewall
• Latest win-acme x64 build
• 30-45 minutes for the first setup

This guide assumes the IIS site already works over plain HTTP before you request the certificate.

Step 1 - Confirm IIS is installed

Open PowerShell as Administrator.

Get-WindowsFeature -Name Web-Server
Get-Service W3SVC

Expected result:

Web-Server  Installed
W3SVC       Running

If IIS is not installed, install it:

Install-WindowsFeature -Name Web-Server -IncludeManagementTools

Then confirm the IIS service is running:

Get-Service W3SVC

If you are hosting ASP.NET Core, install the .NET Hosting Bundle before certificate setup.

Step 2 - Confirm the site has IIS bindings

win-acme reads IIS bindings. Check current bindings:

Import-Module WebAdministration
Get-WebBinding | Select-Object protocol, bindingInformation

A blank binding looks like this:

http     *:80:
https    *:443:

For Let's Encrypt, a hostname-specific binding is better:

http     *:80:app.example.com
https    *:443:app.example.com

If your site has no hostname binding, add one:

New-WebBinding -Name "Default Web Site" -Protocol http -Port 80 -HostHeader "app.example.com"

Replace:

Default Web Site

with your IIS site name, and replace:

app.example.com

with your real hostname.

Verify again:

Get-WebBinding -Name "Default Web Site" | Select-Object protocol, bindingInformation

Do not continue until the IIS site has the hostname you plan to secure.

Step 3 - Point DNS to your Raff VPS

In your DNS provider, create or verify this record:

Then verify DNS from the server:

Resolve-DnsName app.example.com

You can also verify from your local computer:

nslookup app.example.com

The returned IP must match the public IP shown in your Raff dashboard.

Do not continue if DNS still points to the old server. Let's Encrypt will validate the hostname you request. If DNS points somewhere else, validation fails or validates the wrong machine.

Step 4 - Open ports 80 and 443

HTTP validation needs port 80 reachable from outside. HTTPS traffic needs port 443 reachable from outside.

Enable the built-in IIS firewall rules:

Enable-NetFirewallRule -DisplayName "World Wide Web Services (HTTP Traffic-In)"
Enable-NetFirewallRule -DisplayName "World Wide Web Services (HTTPS Traffic-In)"

Confirm the rules are enabled:

Get-NetFirewallRule -DisplayName "World Wide Web Services (*Traffic-In)" |
    Select-Object DisplayName, Enabled, Direction, Action

Expected result:

World Wide Web Services (HTTP Traffic-In)     True    Inbound    Allow
World Wide Web Services (HTTPS Traffic-In)    True    Inbound    Allow

From your local machine, test port 80 before requesting the certificate:

Test-NetConnection app.example.com -Port 80

Expected result:

TcpTestSucceeded : True

If this returns False, fix firewall, DNS, or IIS before running win-acme.

Step 5 - Download and unpack win-acme

Download the latest x64 win-acme ZIP from the official win-acme site:

https://www.win-acme.com/

Use a permanent folder, not Downloads. The scheduled renewal task will call this program later.

Recommended path:

C:\Tools\win-acme

Create the folder:

New-Item -ItemType Directory -Path "C:\Tools\win-acme" -Force

Extract the ZIP into:

C:\Tools\win-acme

Make sure wacs.exe is directly inside that folder:

C:\Tools\win-acme\wacs.exe

Move into the folder:

Set-Location "C:\Tools\win-acme"

Run win-acme:

.\wacs.exe

This confirms win-acme can start and connect to Let's Encrypt.

Step 6 - Understand the host binding requirement

If you choose the simple IIS path and win-acme says:

No websites with host bindings have been configured in IIS.

that means your IIS site has only blank bindings, such as:

*:80:
*:443:

Fix this by adding a real hostname binding:

New-WebBinding -Name "Default Web Site" -Protocol http -Port 80 -HostHeader "app.example.com"

Then verify:

Get-WebBinding -Name "Default Web Site" | Select-Object protocol, bindingInformation

Run win-acme again after DNS and hostname binding are correct.

Step 7 - Issue the certificate with win-acme

From the win-acme folder, run:

Set-Location "C:\Tools\win-acme"
.\wacs.exe

Choose:

N: Create certificate (default settings)

Then select the IIS site or hostname binding for your domain.

During the wizard:

1. Choose the IIS binding for your hostname.
2. Use Let's Encrypt as the certificate authority.
3. Accept the subscriber agreement.
4. Enter an operations email address you monitor.
5. Let win-acme install the certificate into IIS.
6. Allow win-acme to create or update the scheduled renewal task.

Expected success flow:

Authorization result: valid
Requesting certificate
Success
Installing certificate in the certificate store
Adding https binding *:443:app.example.com
Adding task for automatic renewal
Certificate created successfully

This screenshot is an illustrative example of the expected success flow. Your domain, site ID, timestamps, and renewal date will be different.

Step 8 - Verify the HTTPS binding in IIS

After win-acme creates the certificate, verify the IIS binding.

PowerShell:

Get-WebBinding -Name "Default Web Site" |
    Select-Object protocol, bindingInformation, certificateHash

Expected result:

http     *:80:app.example.com
https    *:443:app.example.com    A1B2C3D4...

You can also check in IIS Manager:

IIS Manager -> Sites -> Your site -> Bindings

This screenshot is an illustrative example of the IIS binding screen after certificate installation.

Step 9 - Test HTTPS access

Test from the server:

Invoke-WebRequest "https://app.example.com" -UseBasicParsing

Expected result:

StatusCode        : 200
StatusDescription : OK

Then test from your local browser or phone:

https://app.example.com

The browser should show a valid certificate for your hostname.

If the browser still shows the old certificate, restart IIS:

iisreset

Then test again in a private browser window.

Step 10 - Verify automatic renewal

Let's Encrypt certificates are short-lived by design, so renewal automation is part of the setup.

From the win-acme folder:

Set-Location "C:\Tools\win-acme"
.\wacs.exe --list

Check the scheduled task:

Get-ScheduledTask | Where-Object TaskName -like "*win-acme*" |
    Select-Object TaskName, State, TaskPath

Expected result:

TaskName   State  TaskPath
--------   -----  --------
win-acme   Ready  \

Run a renewal check:

.\wacs.exe --renew

This checks renewals that are due.

For testing automation before production, use win-acme test mode:

.\wacs.exe --test

Use test mode while developing the command or testing automation. Move to production only after DNS, firewall, and IIS bindings are correct.

Optional - Create the certificate unattended

Use unattended mode after the interactive setup works. Replace the domain, site ID, and email address.

Set-Location "C:\Tools\win-acme"

.\wacs.exe `
    --source iis `
    --siteid 1 `
    --host app.example.com,www.app.example.com `
    --validation selfhosting `
    --store certificatestore `
    --installation iis `
    --accepttos `
    --emailaddress admin@example.com

What each argument does:

Common mistakes

DNS points to the old server

Symptom:

Authorization failed
The ACME server could not connect to http://app.example.com/.well-known/acme-challenge/...

Check:

Resolve-DnsName app.example.com

Fix the A record. Wait for DNS propagation. Then rerun win-acme.

Port 80 is closed

Symptom:

Timeout during connect

Check from outside the server:

Test-NetConnection app.example.com -Port 80

Fix Windows Firewall first. Then check any external firewall, network firewall, or DNS proxy in front of the VPS.

The IIS site has no host header

Symptom: win-acme says no websites with host bindings were found.

Check:

Get-WebBinding | Select-Object protocol, bindingInformation

Fix:

New-WebBinding -Name "Default Web Site" -Protocol http -Port 80 -HostHeader "app.example.com"

You created the certificate from Downloads

Symptom: renewal fails weeks later because the scheduled task points to a path that was moved or deleted.

Fix: keep win-acme in a stable folder:

C:\Tools\win-acme

Then recreate or repair the renewal from that path.

You test production too many times

Let's Encrypt has rate limits. Use staging/test mode while debugging:

.\wacs.exe --test

Move to production only after DNS, firewall, and IIS bindings are correct.

Troubleshooting commands

Check what owns port 80:

Get-Process -Id (Get-NetTCPConnection -LocalPort 80).OwningProcess

Check HTTP URL reservations:

netsh http show urlacl

Check IIS bindings:

Get-WebBinding | Select-Object protocol, bindingInformation

Check certificate store entries:

Get-ChildItem Cert:\LocalMachine\WebHosting |
    Sort-Object NotAfter -Descending |
    Select-Object Subject, NotAfter, Thumbprint

If the certificate is stored in Personal instead of WebHosting:

Get-ChildItem Cert:\LocalMachine\My |
    Sort-Object NotAfter -Descending |
    Select-Object Subject, NotAfter, Thumbprint

What Raff recommends

For IIS SSL on a Windows VPS, Raff recommends:

1. Confirm IIS works over HTTP first.
2. Add a real hostname binding before running win-acme.
3. Point DNS to the Raff VPS public IP.
4. Open TCP 80 and 443.
5. Keep win-acme in a permanent folder.
6. Use the interactive wizard for the first certificate.
7. Verify the HTTPS binding after issuance.
8. Test HTTPS from outside the server.
9. Confirm automatic renewal is configured.
10. Use staging/test mode when debugging repeated failures.

Do not treat certificate issuance as the first step. DNS, IIS binding, and firewall checks come first.

Tested on

Tested on Raff Windows VPS, Windows Server 2025 Datacenter Evaluation, IIS 10, win-acme 2.2.9.1701, HTTP-01 validation workflow, 2026-05-26. We verified IIS installation, IIS bindings, firewall checks, win-acme startup and Let's Encrypt connectivity, and documented the expected certificate creation, HTTPS binding, and renewal workflow. Tester: Serdar Tekin.

What's next

• Connect to a Windows VPS via RDP - connect to your server first
• Host ASP.NET Core on IIS - deploy the app before adding SSL
• IIS Application Pool Tuning for Production - tune app pools after deployment
• Configure Windows Firewall on a Windows VPS - manage inbound HTTP, HTTPS, RDP, and SQL rules
• Raff Windows VPS - deploy a Windows Server VPS for IIS, ASP.NET Core, SQL Server, and business apps

Sources

• win-acme official site: https://www.win-acme.com/
• win-acme GitHub repository: https://github.com/win-acme/win-acme
• win-acme command-line reference: https://www.win-acme.com/reference/cli
• win-acme IIS source plugin: https://www.win-acme.com/reference/plugins/source/iis
• win-acme IIS installation plugin: https://www.win-acme.com/reference/plugins/installation/iis
• win-acme HTTP self-hosting validation: https://www.win-acme.com/reference/plugins/validation/http/selfhosting
• Microsoft Learn - IIS binding documentation: https://learn.microsoft.com/en-us/iis/configuration/system.applicationHost/sites/site/bindings/binding
• Let's Encrypt rate limits: https://letsencrypt.org/docs/rate-limits/
• Date last verified: 2026-06-02