How to install a Let’s Encrypt SSL cert on Microsoft IIS

If you’ve ever wondered how to install a Let’s Encrypt certificate on a Microsoft IIS server than this post is just for you.

Let’s Encrypt has always been pretty easy to setup on a Linux box and not so much on the Windows side. Thankfully, there are now nearly a dozen different tools that make adding a Let’s Encrypt SSL certificate to a Microsoft IIS server just as easy.

In this post we’ll be focusing in on, and using the Windows ACME Simple (WACS) solution. Mostly because it’s so easy to use, how easy? Well lets take a look!

Install Let’s Encrypt on Microsoft IIS webserver

1. Download the latest Windows ACME Simple (WACS) ZIP file from the Github releases page, https://github.com/PKISharp/win-acme/releases.
   At the time of writing this post, it is win-acme.v2.0.3.206.zip
2. Next extract the zip file to a folder of your choice. In this example I’m placing it in my C:\inetpub\letsencrypt folder.
   
3. Right click on wacs.exe and select Run as Administrator to start the Windows ACME Simple wizard.
   
4. Select N to create a new certificate.
   
5. Next you’ll be prompted for what kind of cert to create. Select 1 for a single binding of an IIS site.
   
6. Now select which site binding to configure. Since we only have one site on this IIS server there is only one option. Select 1.
   
7. Enter an email address to be used for notifications about any potential issues.
   
8. Finally, agree to the Terms of service and the Windows ACME Simple program takes care of the rest.
   

That’s it for installing a Let’s Encrypt SSL cert on IIS.

In the background Windows ACME Simple will configure your IIS site to use the newly received Let’s Encrypt certificate. You can verify this by looking at the site binding details.

In addition Windows ACME Simple also adds a task to the Windows Task Scheduler which will automatically renew the Let’s Encrypt for you!

How to redirect HTTP to HTTPS in IIS

Now that you have a Let’s Encrypt SSL certificate added to your Microsoft IIS site, you will most likely want to redirect all non-secure (HTTP) traffic to HTTPS.

To do so, you will need to download and install the IIS Rewrite Module from here, https://www.iis.net/downloads/microsoft/url-rewrite.

Once that is completed, just follow the below steps.

1. Open IIS Manager and select the website on the left and open URL Rewrite.
   
2. Click on Add Rule then select Blank rule.
   
3. Next give the new rule a name and under Match URL change the Requested URL to “Matches the Pattern” and Using to “Regular Expressions” and for the Pattern type in (.*)
   
4. Expand the Conditions block and under Logical Grouping change the drop down to Match All and click on Add.
5. For the Condition input type in {HTTPS} in Add Condition prompt. For Check if input string select Matches the Pattern. For Pattern enter ^OFF$
   
6. Now expand the Action block and select Redirect for the Action Type. In the Redirect URL enter: https://{HTTP_HOST}/{R:1} and set the Redirect type select Permanent (301)
   
7. Finally, click Apply

I’ve been a big fan and donor of Let’s Encrypt for a long while now. Let’s Encrypt certs are automated, offer short lifetimes (90 days) and are completely FREE! What’s not to like about them?