Auto SSL on Windows IIS (win-acme)

win-acme (wacs.exe) is an ACME client for Windows that creates HTTPS bindings in IIS and a scheduled task for renewal on its own. It supports external account binding (EAB), so it works with Auto SSL directly.

Where to get the keys

1. In the client area at 1host.kz/bill open the "Auto SSL (Sectigo ACME)" service (order it on the Auto SSL page).
2. Click "Configure Now", enter the domains in "Single Domains" (www and non-www count as one domain), wildcards in "Wildcard Domains".
3. In 5–30 seconds the card shows ACME account ID, EAB MAC ID, EAB MAC key, Server URL.

In the commands: Server URL is https://acme.sectigo.com/v2/DV, YOUR_EAB_KID is the EAB MAC ID, YOUR_EAB_HMAC_KEY is the EAB MAC key.

What you need

• Windows Server with the IIS role, administrator rights, PowerShell.
• A site in IIS with an HTTP binding for the required names (example.kz, www.example.kz).
• The domain points to the server; port 80 is open in Windows Firewall and on the network firewall.

Installing win-acme

1. Download the latest release from win-acme.com (the win-acme.v*.x64.pluggable.zip archive).
2. Unpack it into a permanent folder, e.g. C:\win-acme — the renewal task will run from there, so do not move it later.
3. Open PowerShell as administrator and change to the folder: cd C:\win-acme.

Issuing a certificate for an IIS site

Find the site ID in IIS (IIS Manager → Sites, the ID column) and run one command: it registers the account with the EAB keys, validates the domains through IIS, puts the certificate into the store and creates HTTPS bindings:

.\wacs.exe --source iis --siteid 1 --host example.kz,www.example.kz `
  --baseuri https://acme.sectigo.com/v2/DV `
  --eab-key-identifier YOUR_EAB_KID --eab-key YOUR_EAB_HMAC_KEY `
  --emailaddress [email protected] --accepttos

Where: --source iis takes the names from IIS bindings (and triggers unattended mode), --siteid is the site ID, --host selects which names to include (all must be in the subscription), --baseuri is the ACME server address, --eab-key-identifier and --eab-key are the keys from the client area, --accepttos accepts the CA's terms. Without --host win-acme takes all bindings of the site.

The account is stored in %ProgramData%\win-acme\acme.sectigo.com_v2_DV\; for further certificates on this server --baseuri is enough, the keys need not be repeated. You can also work interactively: run .\wacs.exe without parameters, but pass --baseuri and the EAB keys on the command line first — there is nowhere to enter them in the menu.

Other services and wildcard

To update the certificate in RDP, Exchange or RDS after every renewal, add an installation script to the issue command: --installation iis,script --script "C:\win-acme\Scripts\ImportRDGateway.ps1" --scriptparameters "{CertThumbprint}" — ready-made example scripts are in the Scripts folder of the distribution.

For *.example.kz DNS validation is required: specify --validation with your DNS provider's plugin (e.g. cloudflare) and its parameters per the win-acme documentation, and the domain as --host example.kz,*.example.kz with --source manual. If the domain's DNS is on our ns1/ns2.1host.kz, contact support — we will help.

Common errors

• Port 80 is in use or closed — http-01 validation fails. Make sure IIS listens on 80 (netstat -ano | findstr :80) and the port is open in the firewall.
• The domain does not point to the server — Resolve-DnsName example.kz must return this server's IP.
• The CA rejects the order — the domain is not in the Auto SSL subscription; add it in the client area ("Add domain").
• The certificate was issued but the site serves the old one — check the site's HTTPS bindings in IIS: the new certificate must be selected (win-acme updates bindings by thumbprint itself if it created them).

Verification and renewal

Open the site over HTTPS: the certificate issuer is Sectigo. From PowerShell, list win-acme certificates and expiry dates:

.\wacs.exe --list
Get-ChildItem Cert:\LocalMachine\WebHosting | Format-List Subject,Issuer,NotAfter

Renewal is performed by the scheduled task "win-acme renew (acme-v02…)" that win-acme creates on the first issuance; it runs daily and renews certificates 55 days before expiry. Check that the task exists, or recreate it:

Get-ScheduledTask | Where-Object TaskName -like "win-acme*"
.\wacs.exe --setuptaskscheduler

Run a renewal manually: .\wacs.exe --renew --force. Logs are in %ProgramData%\win-acme\…\Log. The Auto SSL subscription is renewed by an invoice once a year (issued 14 days in advance); while it is active, certificates renew on their own. Help with setup — ONEHOST support via the client area, around the clock.