The following instructions will guide you through installing an ACME-enabled Certificate-as-a-Service certificate on an IIS or Windows web server running on Windows Server. This guide uses win-acme, one of the most popular ACME client for Windows, which can automatically obtain and install certificates and configure your web bindings. After you complete the initial setup, your SSL certificate should be hands-free: renewals and updates happen automatically via a daily Windows Task Scheduler event without you needing to worry about it.

Prerequisites
Before starting, ensure you have gathered the following pieces of information:
  • Sectigo ACME Directory URL (Server URL): https://acme.sectigo.com/v2/DV
  • EAB Key ID (EAB MAC ID): Your unique external account identifier.
  • EAB HMAC Key (EAB MAC key): The secret key used to cryptographically sign your registration.
  • Port 80 Open: Sectigo’s servers must be able to reach your Windows server over HTTP-01 to verify the challenge file. Ensure perimeter firewalls do not block inbound global IP addresses on Port 80 during validation.  You can use a rewrite rule to drop all port 80 traffic not directed at "/.well-known/acme-challenge/" to narrow the scope if desired.

 

1. Download and Extract Win-ACME
You can download the latest pluggable version from the win-acme official site. Extract the contents to a permanent automation folder on your server (e.g., C:\win-acme\).
2. Run Win-ACME and Configure Your Certificate

       Open Command Prompt or PowerShell as an Administrator, navigate to your folder (cd C:\win-acme), and launch the client by running winacs.exe

3. Configure the Sectigo ACME Endpoint

Type M to create certificate with full options.

Select Target: Choose how win-acme should discover your domain (e.g., 1 for an IIS site, or 2 to enter the domain names manually).

ACME Server: When prompted for the ACME server directory, choose the option to input a custom URL.

Enter URL: Paste your specific Sectigo ACME Directory URL: https://acme.sectigo.com/v2/DV

4. Authenticate with External Account Binding (EAB)

The client will recognize that Sectigo requires EAB. Select Y (Yes) to use External Account Binding.

Key ID: Paste your Sectigo EAB Key ID (KID).

HMAC Key: Paste your Sectigo EAB HMAC Key.

Email: Provide an administrative tech support email address (e.g., it@yourcompany.com) for expiration notices.

5. Select File-Based Verification (HTTP-01)

Validation Plugin: When asked how to prove domain ownership, select [http-01] (Save verification files to a local or network path).

Web Root Path:

If using IIS, select the IIS Site option; win-acme automatically creates the .well-known/acme-challenge/ directory structure.

If using a different web server, choose local network path and point it directly to your specific website's public root directory (e.g., C:\Apache24\htdocs\).

6. Finalise Private Key and Installation

Key Type: Select your preferred encryption algorithm. ECC 256 provides better security, performance, and longevity. RSA 2048 is slower and will be phased out in coming years as minimum security requirements increase.

Store Certificate: Choose Windows Certificate Store (Standard or WebHosting) so IIS can access it.

Installation Steps: Select IIS to automatically update your bindings, or None if you plan to link the certificate manually.

 

Automated Renewal
Win-ACME automatically registers a daily Windows Task Scheduler event called win-acme renew. When your Sectigo certificate drops below the renewal threshold (typically 30 days before expiration), the scheduled task runs the exact file-based validation routine silently in the background.

Note: Before finishing, double check the Task Schedule event is running.  If it's not the certificate will not be renewed! 

If you have more certificates to install you can combine the commands into one line;

wacs.exe --baseuri "https://acme.sectigo.com/v2/DV" --eab-key-id "YOUR_EAB_KEY_ID" --eab-hmac-key "YOUR_EAB_HMAC_KEY" --target iis --siteid 1 --validation http-01 --webroot "C:\inetpub\wwwroot" --store certificate_store