Host a website with IIS and Let's Encrypt SSL on Windows Server

Introduction

IIS is the native web server of Windows Server. Combined with win-acme (formerly letsencrypt-win-simple), it lets you obtain and automatically renew free Let's Encrypt SSL certificates, exactly like Certbot on Linux.

Prerequisites

• Windows Server 2019/2022/2025 VPS
• Administrator access via RDP
• Ports 80 and 443 open in Windows Firewall
• A domain name pointing to your VPS

Step 1: Install IIS

Open PowerShell as administrator:

Install-WindowsFeature -Name Web-Server -IncludeManagementTools

Verify installation:

Get-Service W3SVC

The service must be Running.

Test by opening a browser at http://localhost from the VPS. The IIS welcome page should display.

Step 2: Create a site

Open Internet Information Services (IIS) Manager: Start → inetmgr.

1. Right-click on Sites → Add Website
2. Site name: mysite
3. Physical path: C:\inetpub\mysite
4. Host name: your-domain.com
5. Port: 80
6. Check Start website immediately

Create the folder and a test file:

New-Item -ItemType Directory -Path C:\inetpub\mysite -Force
"<h1>VeryCloud rocks</h1>" | Out-File C:\inetpub\mysite\index.html

Test: http://your-domain.com must display the page.

Step 3: Open ports 80 and 443

New-NetFirewallRule -DisplayName "HTTP" -Direction Inbound -LocalPort 80 -Protocol TCP -Action Allow
New-NetFirewallRule -DisplayName "HTTPS" -Direction Inbound -LocalPort 443 -Protocol TCP -Action Allow

Step 4: Download win-acme

Download the latest win-acme release:

https://github.com/win-acme/win-acme/releases

Get the win-acme.v2.x.x.x.x64.pluggable.zip file.

Extract into C:\Program Files\win-acme\.

Step 5: Run win-acme

Right-click wacs.exe → Run as administrator.

Interactive menu:

N: Create new certificate (simple for IIS)

Select N. win-acme automatically detects all your IIS sites.

1. Select the site to protect (enter the number)
2. Choose Pick bindings manually or use defaults for all HTTPS bindings
3. Validation type: http-01 (default, validates via port 80)
4. Contact email for Let's Encrypt
5. Accept terms
6. win-acme generates the CSR, validates the domain, downloads the certificate and installs it automatically in IIS

Step 6: Verify the certificate

Go back to IIS Manager:

• Click on your site → Bindings
• You now see an https binding on port 443 with your certificate

Test: https://your-domain.com must open with a green padlock.

Step 7: Automatic renewal

win-acme automatically installs a Windows scheduled task that runs daily to check and renew certificates expiring in less than 30 days.

Verify in Task Scheduler:

• Look for win-acme renew
• Status: Ready
• Next run: tomorrow

To manually test renewal:

& "C:\Program Files\win-acme\wacs.exe" --renew --baseuri "https://acme-v02.api.letsencrypt.org/"

Step 8: Force HTTPS (301 redirect)

In IIS Manager, select your site → URL Rewrite (to be installed if missing).

Otherwise, edit web.config at the site root:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <rewrite>
      <rules>
        <rule name="HTTPS Redirect" stopProcessing="true">
          <match url="(.*)" />
          <conditions>
            <add input="{HTTPS}" pattern="off" />
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}/{R:1}"
                  redirectType="Permanent" />
        </rule>
      </rules>
    </rewrite>
  </system.webServer>
</configuration>

If URL Rewrite isn't installed:

# Download and install: https://www.iis.net/downloads/microsoft/url-rewrite

Step 9: Enable HTTP/2 and TLS 1.3

HTTP/2 is enabled by default on Windows Server 2019+. Verify with ssllabs.com/ssltest.

To enable TLS 1.3 (Windows Server 2022/2025 only):

# Enable TLS 1.3
$tls13Path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3"
New-Item -Path "$tls13Path\Server" -Force
New-ItemProperty -Path "$tls13Path\Server" -Name "Enabled" -Value 1 -PropertyType DWORD -Force
New-ItemProperty -Path "$tls13Path\Server" -Name "DisabledByDefault" -Value 0 -PropertyType DWORD -Force

Reboot:

shutdown /r /t 0

Troubleshooting

"The HTTP request failed validation"

Let's Encrypt can't validate your domain via port 80. Check:

1. DNS correctly points to your IP: nslookup your-domain.com
2. Port 80 is open in Windows Firewall AND Netrix (VeryCloud customer area)
3. No other service runs on port 80

"Certificate request failed"

Read detailed logs:

Get-Content "C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\log\*.log" -Tail 100

Missing HTTPS binding after renewal

Run manually:

& "C:\Program Files\win-acme\wacs.exe"
# Choose "Manage renewals" then your site

Useful commands

# IIS status
Get-Service W3SVC

# Restart IIS
iisreset

# List all sites
Get-IISSite

# List HTTPS bindings
Get-IISSiteBinding

# Renew all win-acme certificates
& "C:\Program Files\win-acme\wacs.exe" --renew

# View installed certificates
Get-ChildItem Cert:\LocalMachine\WebHosting

Conclusion

Your Windows VPS now hosts professional websites with automatic HTTPS. IIS remains an excellent web server on Windows, especially for .NET stacks, but also to host static, PHP or Node.js (via iisnode) sites.

Going further:

• Host multiple sites with their own SNI certificates
• Install ARR (Application Request Routing) for reverse proxy to Node.js / Python
• Use Cloudflare in front of IIS for global performance

Resources

• win-acme: https://www.win-acme.com
• IIS documentation: https://learn.microsoft.com/en-us/iis
• URL Rewrite Module: https://www.iis.net/downloads/microsoft/url-rewrite
• VeryCloud guide — Windows Firewall: https://verycloud.fr/docs/article/windows-firewall