Windows certificates with win-acme and SimpleACME DNS-01

Windows services often need a certificate without needing a public website on the same machine. DNS-01 separates domain validation from the application's inbound HTTP routing. With SimpleACME, win-acme can use a delegated challenge record instead of credentials for your main DNS zone.

The certificate still belongs to your ACME client and Windows deployment. SimpleACME does not import certificates into the Windows store or configure an IIS binding by itself. Those steps should be explicit parts of the renewal you save.

Choose the validation workflow

win-acme offers DNS validation integrations, including script-based validation. A script workflow is useful when you want to control how an existing SimpleACME registration is used and how failures are reported. Our subscriber example uses a PowerShell hook and a protected account mapping.

Create the SimpleACME domain first and copy the registration from the account. Do not rely on an integration automatically registering against an open endpoint: SimpleACME's registration process is controlled by its account and payment workflow.

Prepare a Windows renewal

1. Confirm the hostname or wildcard names that the target application needs.
2. Add and verify the exact challenge CNAME supplied in SimpleACME.
3. Store credentials under a protected application-data folder, outside a website's document root.
4. Configure win-acme DNS script validation with the appropriate create and cleanup arguments.
5. Choose the intended certificate store and installation step.
6. Save the renewal and check the identity used by its scheduled task.

The scheduled-task account must be able to read its credential file and reach the update endpoint. A successful interactive run under an administrator account does not prove that an unattended task will have the same permissions.

Make the PowerShell hook fail clearly

A useful hook uses terminating HTTP errors, validates the supplied TXT value and checks DNS propagation before reporting success. It should not print the API password to a transcript or swallow an update failure while returning exit code zero.

Protect the file with Windows ACLs and grant only the identities that actually run the renewal. Review downloaded scripts before unblocking them, and avoid disabling execution-policy protections broadly just to make one script run.

Install and verify

For IIS, prefer the client's supported IIS installation integration when it fits the deployment. Other Windows services may need a PFX export, service assignment or vendor-specific import workflow. Test those separately and inspect the certificate presented to a real client afterward.

SimpleACME makes the same DNS workflow repeatable across Windows services and DNS providers. Keep its CNAME and the renewal task in place. Start with the Windows integration overview, then use the subscriber configuration and PowerShell examples to adapt the complete setup.