FairSSL Edition of Simple-ACME
==============================

This is a pre-configured build of Simple-ACME distributed by FairSSL
(https://www.fairssl.dk). It is identical to the official release with
the following modifications:

1. settings_default.json - merged overrides
   - ACME directory pointed to FairSSL: https://fairssl.dk/acme
   - Max domains raised to 250
   - Scheduled task set to run at 01:00
   - RenewalDays set to 365 (ARI handles actual renewal timing)
   - RenewalMinimumValidDays set to 7 as the fallback renewal window
   - Post-renewal script set to Scripts\FairSSLResultNotification.ps1

2. Scripts\FairSSLResultNotification.ps1 - added
   PowerShell script that runs automatically after each renewal and
   certificate-installation attempt (via the DefaultPostExecutionScript
   setting). It reports the result back to your FairSSL control panel so
   you can monitor every certificate and server in one place and be
   alerted when a renewal or installation fails.

   It sends ONLY the following to https://fairssl.dk over HTTPS:
     - kid                your ACME account URL at FairSSL
     - renewal_id         the Simple-ACME renewal identifier (a local GUID)
     - domain             the certificate's primary domain name
     - thumbprint         the certificate's public SHA1 fingerprint
     - status             the overall renewal result
     - install_status     whether the certificate installed successfully
     - install_error_code / install_error_string  a short code and message on failure
     - expiry_at          the certificate's expiry date
     - machine_name       this computer's name
     - script_version / simple_acme_version
     - the sending server's IP address (as seen by our web server)

   It NEVER sends private keys, certificate contents, CSRs, or credentials.
   All errors are silently suppressed so it can never interfere with or
   delay a renewal. To disable it, remove the "DefaultPostExecutionScript"
   entry from settings.json.

3. Additional Scripts\*.ps1 installation scripts - added
   Optional installation scripts used by FairSSL ACME Easy Guides.
   ImportExchange.v3.ps1 enables the certificate on Microsoft Exchange. It
   loads the Exchange management tools locally (no WinRM remoting), so it
   works on any Exchange server including non-domain-joined Edge Transport
   servers, auto-detects the server role and version, and enables only the
   supported services. Add -Hybrid for Office 365 hybrid deployments.
   ImportADFS-WAP.v1.ps1 enables the certificate on Microsoft AD FS or
   Microsoft Web Application Proxy (WAP). The two roles sit behind the same
   federation hostname and are easy to mix up, so the script detects which
   role service this server runs (adfssrv or appproxysvc), states the detected
   role in the log, and applies the matching installation.
   On AD FS it grants the AD FS service account read access to the private key
   and assigns the SSL + Service-Communications certificate. It is farm-aware:
   on a secondary node it skips primary-only changes, and it tolerates the
   farm-wide SSL binding not being ready yet so the last node to renew applies
   it. On WAP it reads the names in the certificate and binds it to the AD FS
   federation proxy and/or any published application whose external address
   the certificate covers; run it on each WAP server (use the same key and CSR
   so every server presents the identical certificate). Both role paths load
   their PowerShell module locally (no WinRM remoting), so they work on
   domain-joined or workgroup DMZ servers.
   ImportADFS.v2.ps1 and ImportWAP.v1.ps1 remain as compatibility wrappers for
   renewals created with earlier bundles; they forward to ImportADFS-WAP.v1.ps1.
   ImportPRTG.ps1 deploys PEM files to PRTG Network Monitor.
   ImportCustomWindows.ps1 is a template for Windows services that need
   certificate store, PFX, and PEM outputs. Deploy-FortiGate.ps1,
   Deploy-FortiMail.ps1, Deploy-FortiWeb.ps1, and
   Install-NetScalerCert.ps1 deploy PEM certificates to supported
   appliances.

4. Scripts\*.ps1 - upstream reference scripts - added
   As of Simple-ACME v2.4.0 the reference scripts are no longer shipped
   inside the program download. To keep them available we fetch the
   Installation scripts from the official reference-scripts project
   (https://github.com/simple-acme/reference-scripts) and place them in
   Scripts\, the folder Simple-ACME runs scripts from. These are upstream
   community scripts: review and test them before use. The FairSSL scripts
   (above) are added last and always take precedence on any name clash.

5. Certificates\ folder - added
   An empty folder created next to Scripts so the installation scripts have
   a predictable location to read and write certificate files.

6. fairssl-readme.txt - this file

The upstream Simple-ACME source code is available at
https://github.com/simple-acme/simple-acme and the reference scripts at
https://github.com/simple-acme/reference-scripts.

Download: https://www.fairssl.dk/get/simple-acme
Support:  https://www.fairssl.dk
