I'm looking for a simple, dependable ACME client or service for Windows servers. Our main use cases are IIS and RADIUS/NPS, and manually managing certificates across more than 30 servers has become a major administrative burden now that publicly trusted certificates have relatively short lifetimes. Which Windows-based ACME tools have you used successfully, and which certificate authorities or DNS providers do you pair them with?
4 Answers
Certify The Web is another strong option if you want a graphical interface and centralized management. The enterprise features are paid, but it includes useful deployment scripts and a central dashboard for managing multiple Windows servers.
For PowerShell-based automation, POSH-ACME is flexible and works with ACME-compatible certificate authorities such as Let’s Encrypt. It is particularly useful when certificates need to be copied or installed into services that do not integrate directly with IIS, including NPS/RADIUS. You can run renewal centrally, publish the certificate to a protected share, and use separate scripts on each server to install or bind it.
For IIS specifically, simple-acme or win-acme are probably the easiest starting points because they can detect IIS bindings and run post-renewal scripts. For services with more awkward certificate installation requirements, a PowerShell workflow gives you more control. Let’s Encrypt is a common choice, while DNS API plugins such as Cloudflare can make wildcard or DNS-01 validation easier.
win-acme has worked well for IIS, especially with Let’s Encrypt and the Cloudflare DNS API plugin. It can handle common IIS bindings without much effort. There is also a newer project called simple-acme that appears to continue the same general approach, so it may be worth evaluating for new deployments.
The main thing I’d add is monitoring. Renewal failures can go unnoticed, so make sure the scheduled task or client logs are being checked and that you alert before certificates expire.
That approach works, but remember that the deployment scripts and certificate permissions still need regular review. Automating renewal is only part of the job; the consuming service also has to reload or bind the new certificate correctly.