I'm looking for a simple, dependable ACME client or service for Windows servers. Our main targets are IIS and RADIUS/NPS, and managing certificates across more than 30 servers has become difficult now that publicly trusted certificates have a maximum validity of less than a year. Which ACME tools and certificate authorities have worked well for you, and how are you handling renewals, deployment, and failure monitoring?
4 Answers
If you prefer scripting over a graphical management tool, POSH-ACME is a solid choice. It works with ACME-compatible certificate authorities such as Let’s Encrypt and gives you the flexibility to build your own IIS and NPS deployment logic. Just make sure the scripts are logged, scheduled, and monitored rather than treating renewal as a fire-and-forget task.
win-acme has been reliable for IIS, especially with Let’s Encrypt and the Cloudflare DNS API plugin. It’s fairly straightforward to set up and can handle renewals automatically. Simple ACME is also worth evaluating as a newer alternative, particularly if you want automatic IIS binding detection and post-renewal scripts.
Certify The Web is a good fit if you want a more polished Windows experience. It supports IIS, provides deployment scripts, and offers a central dashboard for managing multiple servers. The enterprise features cost money, but the extra visibility can be worthwhile across a larger environment.
For NPS/RADIUS, POSH-ACME is particularly flexible because you can control the certificate deployment with PowerShell. One practical setup is to renew the certificate centrally, place the new wildcard or host certificate on a protected share, and let each application owner run a separate deployment process. That keeps certificate issuance separate from service-specific installation steps.
I’ve found it useful to renew monthly rather than waiting until the final weeks. That leaves plenty of validity on the certificate if an application owner needs extra time to install or restart services.
The part I’d pay close attention to is monitoring failed renewals. The client can renew successfully for months, but you still need an alert when a scheduled task, DNS update, or deployment step breaks.