Host a website on IIS with a free HTTPS certificate

Every Windows Server includes IIS, Microsoft's web server. It hosts ASP.NET and ASP.NET Core applications and static sites, and with the free win-acme client it gets certificates from Let's Encrypt and renews them automatically. This guide takes a Windows VPS or VDS from a fresh install to a working HTTPS site.

Before you start

• A Windows server you can reach over Remote Desktop as administrator; see first steps on a Windows server.
• A domain whose A record (and www) points to the server's IP address; see point a domain to your server. Certificates can only be issued once DNS points to the server.
• Ports 80 and 443 reachable from the internet.

In the examples the domain is example.com and the site files live in C:\inetpub\example.com.

Step 1: Install IIS

Open PowerShell as administrator:

Install-WindowsFeature -Name Web-Server -IncludeManagementTools

For sites built on the classic ASP.NET (.NET Framework 4.x), add its role service as well:

Install-WindowsFeature -Name Web-Asp-Net45

For ASP.NET Core applications, install the .NET Hosting Bundle from Microsoft's .NET download page after IIS, then restart IIS:

net stop was /y
net start w3svc

If you install the Hosting Bundle before IIS, run its installer again afterwards to repair it.

Verify: opening http://localhost on the server shows the IIS start page.

Step 2: Create the site

Create the folder, a test page and the site with bindings for both host names:

New-Item -ItemType Directory -Path "C:\inetpub\example.com"
Set-Content -Path "C:\inetpub\example.com\index.html" -Value "It works"
New-IISSite -Name "example.com" -PhysicalPath "C:\inetpub\example.com" -BindingInformation "*:80:example.com"
New-IISSiteBinding -Name "example.com" -BindingInformation "*:80:www.example.com" -Protocol http

The binding format is IP:port:hostname; * means all addresses of the server. To use an additional IPv4 address for this site, put that address instead of * (see add an additional IPv4 address on Windows Server).

Make sure the firewall lets web traffic in:

New-NetFirewallRule -DisplayName "Web HTTP and HTTPS" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 80,443 -Profile Any

Verify: from your own computer, http://example.com shows "It works".

Step 3: Get a free certificate with win-acme

1. Download the current x64 trimmed release of win-acme from its official website and unpack it to a permanent folder, for example C:\Program Files\win-acme. The renewal task runs from this folder, so do not use a temporary one.
2. Run wacs.exe as administrator.
3. In the main menu, choose N to create a certificate with the default settings.
4. Pick the site example.com from the list of IIS sites and confirm the host names it found in the bindings.
5. On the first run, accept the terms of service and enter an email address for expiry notices.

win-acme proves control of the domain over HTTP on port 80, downloads the certificate, adds an https binding on port 443 for the host names and creates a scheduled task for renewals.

Verify: https://example.com opens with a valid certificate, and Task Scheduler contains a win-acme renewal task.

Step 4: Deploy your application

Copy your published files into C:\inetpub\example.com, replacing the test page. ASP.NET Core apps are published with dotnet publish and need the Hosting Bundle from Step 1. Each site runs in its own application pool; give it a name per site in IIS Manager › Application Pools if you host several sites.

To send visitors from HTTP to HTTPS, install Microsoft's URL Rewrite module for IIS and add a redirect rule, or handle the redirect in your application.

Troubleshooting

win-acme reports that validation failed. Check that example.com resolves to the server (Resolve-DnsName example.com) and that http://example.com is reachable from outside on port 80. A proxy or CDN in front of the site can block the check.

HTTP Error 404 for every page. The site's folder is empty or the default document is missing. Check the folder and Default Document in IIS Manager.

HTTP Error 500.19 or 500.30, or 502.5 on an ASP.NET Core app. Usually the Hosting Bundle or a configuration setting is missing; see ASP.NET and IIS errors.

The browser shows another site's certificate. The host name has no https binding with its own certificate. Run win-acme again for that site, or check the bindings in IIS Manager.

Next steps

• Fix application errors: ASP.NET and IIS errors.
• Commercial certificates (OV, EV, wildcard): order, validate and install an SSL certificate.