Dynamics NAV / Business Central: automated SSL certificate

Q: Does the script restart every BC instance?

No, only the ones whose ServicesCertificateThumbprint changed. If you have multiple BC instances using the same certificate they all restart, but only because they all need updating. If you have different certificates per instance, see the advanced section below.

Q: Which account goes in --acl-fullcontrol?

The account the Business Central service runs as. Run Get-CimInstance Win32_Service -Filter "Name LIKE 'MicrosoftDynamicsNavServer%'" | Select-Object Name,StartName on the BC server and read StartName . Translate the value: simple-acme recognises only the two English names network service and administrators directly, and looks anything else up in Windows under the account's localised name. If it says NT AUTHORITY\NetworkService , write NETWORK SERVICE , not the full name - on a Danish or Swedish Windows the account is called NETVÆRKSTJENESTE, so the full English name cannot be looked up. If it says LocalSystem , write S-1-5-18 . If it says a domain account or a gMSA such as CONTOSO\svc_bc or CONTOSO\svc_bc$ , write it exactly as shown; domain names are not localised. A SID always works, for example S-1-5-20 for NETWORK SERVICE. Separate several accounts with a comma. Without that permission the instance will not start with the new certificate.

Microsoft Dynamics NAV and Business Central on-premise have two certificate touchpoints that have to be updated together: the IIS binding for Web Client, and ServicesCertificateThumbprint on every BC Service Tier instance. simple-acme handles the IIS side, and FairSSL\'s ImportDynamicsNAV.ps1 handles the Service Tier configuration.

Setup

Step 1: Install simple-acme

Grab FairSSL\'s simple-acme build (pre-configured with the right ACME settings and ships ImportDynamicsNAV.ps1 in the Scripts folder). Extract to C:\simple-acme on the BC server.

Step 2: Prepare the environment

The hostname matches what BC clients connect to and is not a wildcard.
The domain is configured for FairSSL AutoDNS.
Schedule a service window - the script restarts BC instances whose thumbprint changes.
Open a command prompt as administrator and cd to C:\simple-acme.
Find the account the BC service runs as - it goes into the Step 3 command. If it says NT AUTHORITY\NetworkService, you write NETWORK SERVICE; see the FAQ on --acl-fullcontrol for the other cases. Get-CimInstance Win32_Service -Filter "Name LIKE 'MicrosoftDynamicsNavServer%'" | Select-Object Name,StartName

Step 3: Issue and deploy

Run the command as administrator. simple-acme issues the certificate via AutoDNS, installs it in the Windows Certificate Store, grants the BC service account full control of the private key, binds it in IIS and runs ImportDynamicsNAV.ps1 to update every running BC instance.

Replace NETWORK SERVICE with the account your BC service runs under. You found it in Step 2. If BC runs as NETWORK SERVICE, leave it as it is.

wacs.exe --verbose --baseuri "https://fairssl.dk/acme" `
  --eab-key-identifier YOUR_EAB_KID --eab-key YOUR_EAB_HMAC --accepttos `
  --source manual --host "bc.example.com" --validation none `
  --certificatestore My --acl-fullcontrol "NETWORK SERVICE" `
  --installation iis,script --script "Scripts\ImportDynamicsNAV.ps1" `
  --scriptparameters "'{CertThumbprint}'" `
  --friendlyname "fairssl-acme-bc.example.com"

Step 4: Verify the IIS binding

Open the BC Web Client URL in a browser and confirm the new certificate is served. If the old one is still served, the IIS binding has no host header for simple-acme to match. Open IIS Manager, go to the BC Web Client site → Bindings → HTTPS → Edit, and pick the new certificate (friendly name fairssl-acme-<host>). Add a host header to the binding while you are there (e.g. *:443:bc.example.com) so future renewals bind automatically.

Step 5: Tune the simple-acme renewal window

If you used the FairSSL simple-acme build, this is already set. Otherwise edit ScheduledTask → RenewalDays to 365 in settings.json in the simple-acme folder. That lets ARI drive renewal rather than a fixed schedule.

Advanced: multiple instances with different certificates

Only if you have multiple BC instances using different certificates. Run the Step 3 command once per certificate/instance pair and extend the script parameters with the instance name:

--scriptparameters "'{CertThumbprint}' 'BC-PROD'"

Frequently asked questions

Find answers to the most common questions about SSL certificates and FairSSL.

Which Dynamics NAV and Business Central versions are supported?

Dynamics NAV 2017+ and Business Central 14+ (on-premise). The ACME flow itself does not care about the BC version. ImportDynamicsNAV.ps1 finds the instances from the MicrosoftDynamicsNavServer$* Windows services and writes straight into each instance's CustomSettings.config, so it needs neither NavAdminTool nor BCAdminTool.

What does the script do at renewal?

It updates CustomSettings.config for every running BC instance so ServicesCertificateThumbprint points at the new certificate, and restarts only those instances whose thumbprint changed. Instances without a change keep running. Access to the private key is not the script's job: it comes from --acl-fullcontrol on the wacs command, which simple-acme reapplies at every renewal.

Does the script restart every BC instance?

No, only the ones whose ServicesCertificateThumbprint changed. If you have multiple BC instances using the same certificate they all restart, but only because they all need updating. If you have different certificates per instance, see the advanced section below.

Which account goes in --acl-fullcontrol?

The account the Business Central service runs as. Run Get-CimInstance Win32_Service -Filter "Name LIKE 'MicrosoftDynamicsNavServer%'" | Select-Object Name,StartName on the BC server and read StartName. Translate the value: simple-acme recognises only the two English names network service and administrators directly, and looks anything else up in Windows under the account's localised name. If it says NT AUTHORITY\NetworkService, write NETWORK SERVICE, not the full name - on a Danish or Swedish Windows the account is called NETVÆRKSTJENESTE, so the full English name cannot be looked up. If it says LocalSystem, write S-1-5-18. If it says a domain account or a gMSA such as CONTOSO\svc_bc or CONTOSO\svc_bc$, write it exactly as shown; domain names are not localised. A SID always works, for example S-1-5-20 for NETWORK SERVICE. Separate several accounts with a comma. Without that permission the instance will not start with the new certificate.

Does the certificate hostname need to match the BC client URL?

Yes. The Web Client and Service Tier endpoints must present a certificate where the common name or SAN matches what clients connect to. BC Web Client does not accept wildcards. Order a SAN certificate if you have both bc.example.com and nav.example.com.

What if the IIS binding has no host header?

simple-acme can only swap an IIS binding automatically when its host header matches the certificate. If the BC Web Client site runs on *:443: (no host header), the browser still serves the old certificate after the first run. Fix: open IIS Manager, add the host header (e.g. bc.example.com), select the new certificate manually once. Future renewals bind automatically.

Can I use the same certificate for BC Web Client and BC Service Tier?

Yes. ImportDynamicsNAV.ps1 updates the Service Tier CustomSettings.config while simple-acme also binds the certificate in IIS for the Web Client site. The same thumbprint is used both places, so renewals cover the full BC stack in one go.

Ready to automate BC certificates?

Create a free account and order your first certificate. A DV certificate is issued in under 2 minutes.

Create free account Compare certificates