# Host a website on IIS with a free HTTPS certificate > Install IIS on Windows Server, create a site with host name bindings, add ASP.NET support and secure it with a free Let's Encrypt certificate via win-acme. Difficulty: Intermediate Every Windows Server includes **IIS**, Microsoft's web server. It hosts ASP.NET and ASP.NET Core applications and static sites, and with the free **win-acme** client it gets certificates from Let's Encrypt and renews them automatically. This guide takes a Windows VPS or VDS from a fresh install to a working HTTPS site. ## Before you start - A Windows server you can reach over Remote Desktop as administrator; see [first steps on a Windows server](/guides/windows-server-first-steps-rdp). - A domain whose **A record** (and `www`) points to the server's IP address; see [point a domain to your server](/guides/point-domain-to-server). Certificates can only be issued once DNS points to the server. - Ports **80** and **443** reachable from the internet. In the examples the domain is `example.com` and the site files live in `C:\inetpub\example.com`. ## Step 1: Install IIS Open PowerShell as administrator: ```powershell Install-WindowsFeature -Name Web-Server -IncludeManagementTools ``` For sites built on the classic **ASP.NET** (.NET Framework 4.x), add its role service as well: ```powershell Install-WindowsFeature -Name Web-Asp-Net45 ``` For **ASP.NET Core** applications, install the **.NET Hosting Bundle** from Microsoft's .NET download page **after** IIS, then restart IIS: ```text net stop was /y net start w3svc ``` If you install the Hosting Bundle before IIS, run its installer again afterwards to repair it. **Verify:** opening `http://localhost` on the server shows the IIS start page. ## Step 2: Create the site Create the folder, a test page and the site with bindings for both host names: ```powershell New-Item -ItemType Directory -Path "C:\inetpub\example.com" Set-Content -Path "C:\inetpub\example.com\index.html" -Value "It works" New-IISSite -Name "example.com" -PhysicalPath "C:\inetpub\example.com" -BindingInformation "*:80:example.com" New-IISSiteBinding -Name "example.com" -BindingInformation "*:80:www.example.com" -Protocol http ``` The binding format is `IP:port:hostname`; `*` means all addresses of the server. To use an additional IPv4 address for this site, put that address instead of `*` (see [add an additional IPv4 address on Windows Server](/guides/add-ipv4-address-windows)). Make sure the firewall lets web traffic in: ```powershell New-NetFirewallRule -DisplayName "Web HTTP and HTTPS" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 80,443 -Profile Any ``` **Verify:** from your own computer, `http://example.com` shows "It works". ## Step 3: Get a free certificate with win-acme 1. Download the current **x64 trimmed** release of win-acme from its official website and unpack it to a permanent folder, for example `C:\Program Files\win-acme`. The renewal task runs from this folder, so do not use a temporary one. 2. Run `wacs.exe` as administrator. 3. In the main menu, choose `N` to create a certificate with the default settings. 4. Pick the site `example.com` from the list of IIS sites and confirm the host names it found in the bindings. 5. On the first run, accept the terms of service and enter an email address for expiry notices. win-acme proves control of the domain over HTTP on port 80, downloads the certificate, adds an `https` binding on port 443 for the host names and creates a scheduled task for renewals. **Verify:** `https://example.com` opens with a valid certificate, and **Task Scheduler** contains a win-acme renewal task. ## Step 4: Deploy your application Copy your published files into `C:\inetpub\example.com`, replacing the test page. ASP.NET Core apps are published with `dotnet publish` and need the Hosting Bundle from Step 1. Each site runs in its own **application pool**; give it a name per site in IIS Manager › **Application Pools** if you host several sites. To send visitors from HTTP to HTTPS, install Microsoft's **URL Rewrite** module for IIS and add a redirect rule, or handle the redirect in your application. ## Troubleshooting **win-acme reports that validation failed.** Check that `example.com` resolves to the server (`Resolve-DnsName example.com`) and that `http://example.com` is reachable from outside on port 80. A proxy or CDN in front of the site can block the check. **HTTP Error 404 for every page.** The site's folder is empty or the default document is missing. Check the folder and **Default Document** in IIS Manager. **HTTP Error 500.19 or 500.30, or 502.5 on an ASP.NET Core app.** Usually the Hosting Bundle or a configuration setting is missing; see [ASP.NET and IIS errors](/guides/aspnet-iis-errors). **The browser shows another site's certificate.** The host name has no `https` binding with its own certificate. Run win-acme again for that site, or check the bindings in IIS Manager. ## Next steps - Fix application errors: [ASP.NET and IIS errors](/guides/aspnet-iis-errors). - Commercial certificates (OV, EV, wildcard): [order, validate and install an SSL certificate](/guides/install-ssl-certificate). ## Frequently asked questions ### Do I need a dedicated IP address for every HTTPS site? No. IIS supports Server Name Indication (SNI), so many sites with their own certificates can share one IP address, and every current browser supports it. ### How does the certificate renew? win-acme creates a scheduled task that renews certificates before they expire and updates the IIS bindings. Keep the win-acme folder where you unpacked it, because the task runs from there. ### Why does validation fail? Usually the domain does not point to the server yet, or port 80 is closed in a firewall. Let's Encrypt's HTTP check connects to your domain on port 80. ### Can I host PHP sites on IIS? Yes, with PHP for Windows and FastCGI, but most PHP software is tested on Linux. For WordPress and similar PHP sites, a Linux server or our web hosting is the easier choice. --- Source: \ Updated: 2026-10-15