Here is how to install Let’s Encrypt SSL on Windows Server IIS. IIS does not include a built-in way to request a free certificate the way some other tools do, so this guide uses win-acme, an open source client built specifically for pairing Let’s Encrypt with IIS. Without a certificate, browsers flag your site as “Not Secure”, and search engines rank unencrypted sites lower than their HTTPS equivalents, so this is not just a cosmetic fix.
What you need
- A Hostner dedicated server running Windows Server with IIS installed
- Administrator access via RDP
- A domain name pointed at your server’s IP address
- A website already set up in IIS under that domain, reachable over plain HTTP on port 80
Step 1: Download win-acme
Open a browser on the server and go to the win-acme releases page on GitHub. Download the latest zip file, then extract it to a folder such as C:\win-acme.
Step 2: Install Let’s Encrypt SSL on Windows Server IIS
Right-click wacs.exe inside that folder and choose “Run as administrator”. If Windows Defender SmartScreen shows a warning that it protected your PC, click “More info”, then click “Run anyway”. This warning appears because the file was downloaded from the internet, it does not indicate a problem with the application itself.
When the win-acme menu appears, press N to create a new certificate. On the next screen, type 1 to choose “Single binding of an IIS site”. Select the site you want to secure from the list that follows.
Step 3: Complete verification and issue the certificate
Enter an email address when prompted, this is only used if Let’s Encrypt needs to contact you about a renewal problem. Type yes to accept the terms of service. Win-acme then verifies domain ownership over HTTP automatically, using a temporary file it places on your site, you do not need to do anything during this step.
Once verification succeeds, win-acme issues the certificate and binds it to your site in IIS directly. No manual import or binding step is needed.
Step 4: Confirm it worked
Open a browser and visit your site using https:// instead of http://. You should see the padlock icon in the address bar with no certificate warning. If you still see a warning, clear your browser cache first, sometimes an old cached version of the page hides a successful certificate install. Win-acme also creates a scheduled task automatically, so the certificate renews on its own before it expires, Let’s Encrypt certificates are valid for 90 days at a time.
If it does not work
If verification fails, the most common cause is port 80 not being reachable from the internet, Let’s Encrypt needs to access that port to confirm you control the domain. Check your firewall and any network security group rules in front of the server. A mismatched or missing DNS record for the domain causes the same symptom, double check the domain actually resolves to this server’s IP before troubleshooting further. For a full list of win-acme’s advanced options, including wildcard certificates for multiple sites at once, the win-acme documentation covers every menu option in detail.
No ticket needed, and no certificate purchase either. A free tool, a few menu choices, and your IIS site runs on HTTPS. The scheduled task win-acme creates means you will not need to repeat any of this in 90 days either.
See more guides in Docs, or check out Install Let’s Encrypt SSL on Linux (nginx) if you manage a Linux server as well.