SimpleACMEWindows DNS-01 with win-acme and SimpleACME
Validate Windows service names without a public HTTP challenge endpoint. Use existing SimpleACME credentials in a reviewed PowerShell DNS hook.
Prepare your domain →Your setup sequence
- Prepare and activate the domain, then add and verify the exact challenge CNAME.
- Store the account mapping in a protected application-data folder readable by the renewal task identity.
- Select win-acme DNS script validation. Its create hook must send the supplied authorization value, fail on update errors and wait for DNS visibility.
- Select the intended certificate store and application installation step. For IIS, prefer the supported IIS installation integration when it fits.
- Test in staging, save the renewal and verify the scheduled task can read credentials and deploy unattended.
Keep the scope clear
SimpleACME serves delegated TXT updates. Your client requests and renews the certificate, protects its key and deploys it. Use a CNAME per configured challenge owner; keep the existing registration and storage persistent. A demo cannot update DNS.
Configuration and script examples
Open the full subscriber guide →
Public starter templates are also available through the read-only MCP. They contain placeholders, not credentials, and must be reviewed for your environment.
Official client references
Your next certificate. A little less complicated.
Keep your DNS provider and your ACME client.
Prepare your domain before activating paid updates.