SSL Automation
Windows, IIS and Exchange
On a Windows server the issuance is the easy part. The work is in what has to happen afterwards, and that is also where the manual renewal usually goes wrong.
The certificate has to reach three places, not one
A new certificate on Windows has to be imported into the certificate store, given read access on the private key for the account the service runs as, and bound to the site. On Exchange it also has to be enabled for the individual services. RDS and ADFS bind on thumbprint, so a new certificate means a new thumbprint that has to go into the configuration.
- Import, set permissions on the key, bind in IIS.
- Exchange: enable the certificate for IIS, SMTP, IMAP and POP.
- RDS and ADFS: update the thumbprint in the configuration.
What the generated setup does
The wizard in the control panel writes a command line for simple-ACME in the FairSSL edition, with the account key and your domain names filled in. The same command creates the scheduled task that renews the certificate from then on.
- Registers the account against the FairSSL ACME server with EAB.
- Fetches the certificate and puts it in the Local Machine store.
- Sets permissions on the private key so the service can read it.
- Binds in IIS and runs the install scripts the platform needs.
Where the certificate ends up
In the Windows certificate store under Local Machine. The IIS binding points at it, and on Exchange it is then enabled for IIS, SMTP, IMAP and POP. The old certificate stays in the store until it expires, so a rollback is moving the binding back.
What to know in advance
Exchange Back End keeps its internal Microsoft Exchange certificate, and that one is renewed separately with the Exchange tools. A wildcard certificate covers OWA, EWS and ActiveSync, but SMTP, IMAP and POP only use it if the exact FQDN is also a SAN in the certificate. IIS 6 to 7.5 can have the certificate issued, but the binding may need a hand.
Supported versions
The wizard in the control panel is written for these versions. If you run an older version than the one listed, ask us before you order.
Windows
| Platform | Versions | Runs on | ACME client | Guide |
|---|---|---|---|---|
| IIS | VersionsIIS 8 and newer | Runs onWindows Server 2012 or newer | ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) | Guide → |
| IIS (legacy) | VersionsIIS 6.0 to 7.5, the IIS binding is set by hand | Runs onWindows Server 2008 R2 or older | ACME clientAn older simple-acme release that still runs on Windows Server 2008 R2 | Guide → |
| Exchange Server | Versions2013, 2016, 2019 and Subscription Edition | Runs onWindows Server 2012 or newer | ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportExchange.v3.ps1 | Guide → |
| Remote Desktop Services | VersionsRD Gateway (also without an RD Connection Broker), RD Web Access, RD Web Client, RD Connection Broker and the RDP listener | Runs onWindows Server 2012 or newer | ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportRDSFullFairSSL.ps1 | Guide → |
| Dynamics NAV / Business Central | VersionsNAV 2013 R2 and newer, every Business Central version (on-premises) | Runs onWindows Server 2012 or newer | ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportDynamicsNAV.ps1 | Guide → |
| AD FS | VersionsThe guide sets no version limit | Runs onWindows Server 2012 or newer | ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportADFS-WAP.v1.ps1 | Guide → |
| Web Application Proxy | VersionsThe guide sets no version limit | Runs onWindows Server 2012 R2 or newer | ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportADFS-WAP.v1.ps1 | Guide → |
| SQL Server | VersionsThe guide sets no version limit | Runs onWindows Server 2012 or newer | ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportSQL.ps1 | Guide → |
| PRTG Network Monitor | VersionsThe guide sets no version limit | Runs onWindows Server 2012 or newer | ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportPRTG.ps1 | Guide → |
| Apache Tomcat | Versions8.5, 9.x, 10.x and 11.x | Runs onWindows Server 2012 or newer | ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportTomcat.ps1 | Guide → |
| Other Windows service | VersionsCertificate store, PFX or PEM, with your own script | Runs onWindows Server 2012 or newer | ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportCustomWindows.ps1 | Guide → |
| Several Windows servers | VersionsReceiving servers: Windows Server 2012 or newer with PowerShell 5.1 and WinRM | Runs onWindows Server 2012 or newer | ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + DistributeToWindowsServers.ps1 | Guide → |
Validation without opening anything inbound to the server
An ACME client that validates over HTTP needs port 80 open inbound to the server. A client that validates over DNS needs an API key for your DNS provider, and that key then sits on the server with write access to your zone. Internal servers and appliances rarely allow either.
The one CNAME you create per domain
_dnsauth.<domain> CNAME <hash>.autodns.fairssl.dk
You create it once per registered domain. FairSSL writes the CA validation record in our own zone, and you do not touch your DNS again at renewal.
One record per domain
Wildcards, SAN names and new subdomains on the same registered domain all use the same CNAME delegation.
No DNS keys on the server
The client never gets access to your DNS zone, so a compromised server cannot change your DNS records.
Outbound HTTPS, no inbound rule
The server has to reach fairssl.dk over HTTPS. No inbound firewall rule is needed, and the server needs no public address.
What is monitored once the client is running
An automation that stops without saying so is worse than a renewal in the calendar. We measure both the certificate and the client that is supposed to renew it.
Renewal window checked hourly
We ask the CA over ARI when the certificate should be renewed and check every hour. If the CA does not answer, we fall back to 21 and 7 days before expiry.
The client stops reporting in
If a client halves its check-in rate we raise a warning. A certificate can stay valid long after the client that was going to renew it stopped running.
Whether the install succeeded
The Windows client reports the result of the install back. A certificate that issued but was never bound to the site counts as a failure.
Email alerts per profile
Alerts are configured per profile, so operations and development can be notified at different addresses.
Monitoring API
Status is available as JSON, or read directly by PRTG and Prometheus, so the certificates appear in the monitoring system you already watch.
Certificates without automation
Certificates that do not run automatically get expiry mail 28 days and 7 days before expiry.
What the automation costs
The fee is charged per main certificate, per year, on top of the price of the certificate itself.
A shorter lifetime means more issuances per year. The number of issuances does not change the price: you pay for the certificate under management, not per renewal.
- Up to 25 servers using that certificate are included in the fee. Each of them gets its own reissued certificate.
- Reissues cost nothing extra.
- Changing the SAN names on the certificate costs nothing extra.
- Additional ACME clients using the same certificate cost nothing extra.
A second certificate is priced on its own: its own certificate price plus the fee for a year.
Worked example and price details →From order to a certificate that renews itself
Step three is the one a generic ACME guide does not have: the setup is written for your platform.
- 1
Order the certificate in the control panel and turn automation on for it.
- 2
Create the CNAME delegation for the domain. Once per registered domain.
- 3
Pick your platform in the wizard. The portal writes the setup command with the account key and the domains filled in, and you copy it with one button.
- 4
Run the command on the server. The client fetches the certificate, installs it and renews it on its own from then on.
We package the Windows client ourselves and rebuild it daily. Linux and macOS use stock lego, which the generated command calls. Download the Windows client
Get started in the control panel →Support by email and phone is free before, during and after the installation. Remote installation is a paid add-on at a fixed price.
Find your platform
The wizard in the control panel writes the setup for the platform you pick, with the account key and the domains already filled in. You copy it with one button and run it on the server.
Windows
Simple-ACME in the FairSSL edition fetches the certificate, installs it in the certificate store and binds it to the site or service.
IIS 8+, IIS 6-7.5, Exchange, RDS, ADFS, WAP, SQL Server, PRTG, Dynamics NAV/BC, Tomcat
Linux
Stock lego with FairSSL as the ACME server. The generated command writes the certificate and reloads the service afterwards.
nginx, Apache, HAProxy, Traefik, Caddy, Postfix, lego
See the setup →macOS
Lego, with the same setup as on Linux.
lego
Appliances
FortiGate 7.6.3 and F5 BIG-IP 21.1.0 and newer speak ACME themselves. Older versions and the other boxes fetch the certificate through an agent or an enrollment URL.
FortiGate, FortiMail, FortiWeb, NetScaler ADC, F5 BIG-IP, Kemp LoadMaster, Cisco ASA, Cisco FDM, Kubernetes cert-manager
See the setup →What is not covered
The wizard does not write a setup for pfSense, Synology, Palo Alto or Sophos. If you run one of them, ask us before you buy and we will look at what can be done.
Certificates on many servers and appliances
A publicly trusted SSL certificate can be valid for at most 199 days now, 99 days by 15 March 2027 and 46 days by 15 March 2029. Each certificate then has to be replaced at least twice a year now and at least eight times a year from 2029, on every server, firewall and load balancer that uses it. sslbrain from FairSSL runs as an appliance in your own network and renews and installs the certificates from one place, including on devices without an agent.
How to connect Windows servers to sslbrain(opens sslbrain.com in a new tab)