WIN-ACME

https://www.win-acme.com/manual
Admin
A simple ACMEv2 client for Windows for use with Let's Encrypt and other ACME services.
Tokens:7,027
Snippets:117
Trust Score:9.2
Update:1 month ago
Show doc for...
Tokens:
Raw
### Example Script Call for Certificate Installation

Source: https://www.win-acme.com/manual/advanced-use/examples/apache

Demonstrates how to call the certificate installation script with necessary parameters.

```bash
wacs.exe --source manual --host www.example.com --webroot "C:\htdocs\www\example.com" --validation filesystem --script "installcert.cmd" --scriptparameters "acme-v02.api.letsencrypt.org C:\cert www.example.com"
```

--------------------------------

### Certificate Installation and Apache Restart Script

Source: https://www.win-acme.com/manual/advanced-use/examples/apache

This batch script copies certificate files and restarts the Apache service. It requires parameters for the source directory, certificate folder, and domain name.

```batch
@echo off
if "%~1" == "" exit
if not exist "%2" md "%2" >nul
set certlist=%3-chain.pem,%3-key.pem
echo Script running...
for %%a in (%certlist%) do copy /y "%ProgramData%\win-acme\%1\%%a" "%2\" >nul && echo. [INFO] Install %%a to Certificate Store in %2... OK || echo. [WARN] Install certificate %%a fieled!
echo. [INFO] Restarting service...
C:\Apache24\bin\httpd.exe -k restart
echo. [INFO] Service restarted.
echo. [INFO] Script finished.

```

--------------------------------

### Manual Certificate Generation for Specific Domain

Source: https://www.win-acme.com/manual/advanced-use/examples/rds

Use this command for manual certificate generation when only blank or catch-all IIS bindings are configured. It requires explicit specification of the domain name and installs the certificate to IIS and RD roles.

```bash
wacs.exe --source manual --host rds.example.com --certificatestore My --installation iis,script --installationsiteid 1 --script "Scripts\ImportRDSFull.ps1" --scriptparameters "{CertThumbprint}"
```

--------------------------------

### Generate Exchange Certificate for Windows Certificate Store

Source: https://www.win-acme.com/manual/advanced-use/examples/exchange

Use this command to generate a certificate for Exchange and store it in the Windows Certificate Store. It configures the certificate for IIS, SMTP, and IMAP services, and installs it on IIS Site ID 1.

```bash
wacs.exe --source manual --host mail.example.com,webmail.example.com,autodiscover.example.com --certificatestore My --acl-fullcontrol "network service,administrators" --installation iis,script --installationsiteid 1 --script "./Scripts/ImportExchange.v2.ps1" --scriptparameters "'{CertThumbprint}' 'IIS,SMTP,IMAP' 1 '{CacheFile}' '{CachePassword}' '{CertFriendlyName}'"
```

--------------------------------

### Unattended Certificate Generation for IIS Bindings

Source: https://www.win-acme.com/manual/advanced-use/examples/rds

Use this command for unattended certificate generation when specific domain names are configured in IIS bindings. It installs the certificate to IIS and runs a script for RD roles.

```bash
wacs.exe --source iis --siteid 1 --certificatestore My --installation iis,script --script "Scripts\ImportRDSFull.ps1" --scriptparameters "{CertThumbprint}"
```

--------------------------------

### Generate Exchange Certificate for Central Certificate Store

Source: https://www.win-acme.com/manual/advanced-use/examples/exchange

This command generates a certificate for Exchange and configures it for use with a Central Certificate Store, suitable for load-balanced environments. It also installs the certificate for IIS, SMTP, and IMAP services on IIS Site ID 1.

```bash
wacs.exe --source manual --host mail.example.com,webmail.example.com,autodiscover.example.com --store centralssl,certificatestore --certificatestore My --acl-fullcontrol "network service,administrators" --centralsslstore "C:\\Central SSL" --installation iis,script --installationsiteid 1 --script "./Scripts/ImportExchange.v2.ps1" --scriptparameters "'{CertThumbprint}' 'IIS,SMTP,IMAP' 1 '{CacheFile}' '{CachePassword}' '{CertFriendlyName}'"
```

--------------------------------

### Unattended Certificate Creation with Manual Source

Source: https://www.win-acme.com/manual/advanced-use

Use the --source manual argument to initiate unattended certificate creation with the manual source plugin.

```bash
wacs.exe --source manual --host www.domain.com --webroot C:\\sites\\wwwroot
```

--------------------------------

### Full Unattended Certificate Creation with IIS Source and Registration

Source: https://www.win-acme.com/manual/advanced-use

This command creates a certificate for IIS site 1, excluding a specific binding, and automatically registers with Let's Encrypt by providing an email address and accepting terms of service.

```bash
wacs.exe --source iis --siteid 1 --excludebindings exclude.me --emailaddress myaddress@example.com --accepttos
```

--------------------------------

### Unattended Certificate Creation with IIS Source

Source: https://www.win-acme.com/manual/advanced-use

Use the --source iis argument to initiate unattended certificate creation with the IIS source plugin, specifying site ID and excluding bindings.

```bash
wacs.exe --source iis --siteid 1 --excludebindings exclude.me
```

--------------------------------

### Enable SSL Module and Listen Port in Apache

Source: https://www.win-acme.com/manual/advanced-use/examples/apache

Ensure the SSL module is uncommented in httpd.conf and that Apache is configured to listen on port 443.

```apache
#LoadModule ssl_module modules/mod_ssl.so
Listen 443
```

--------------------------------

### Apache Virtual Host SSL Configuration

Source: https://www.win-acme.com/manual/advanced-use/examples/apache

Configure your Apache 2.4 virtual host to use the generated SSL certificates. Replace 'example.com' with your actual domain and adjust paths as necessary.

```apache
Define CERTROOT "C:/apache-certs"
Define SITEROOT "C:/htdocs/www"
....
<VirtualHost *:443>
    ServerName www.example.com
    DocumentRoot "${SITEROOT}/example.com"
....
    SSLEngine on
    SSLCertificateFile "${CERTROOT}/example.com-chain.pem"
    SSLCertificateKeyFile "${CERTROOT}/example.com-key.pem"
</VirtualHost>

```

--------------------------------

### Configure IIS Handler Mappings for ACME Challenge

Source: https://www.win-acme.com/manual/validation-problems

Move the StaticFile mapping above ExtensionlessUrlHandler mappings in IIS for the /.well-known/acme-challenge/ folder to serve static files correctly.

```xml
Handler Mappings -> View Ordered List
```

--------------------------------

### Configure Serilog Minimum Level

Source: https://www.win-acme.com/manual/advanced-use/custom-logging

Change the log level by adding this setting to your configuration.

```xml
<add key="serilog:minimum-level" value="Verbose" />
```

--------------------------------

### Add CAA Record for Let's Encrypt

Source: https://www.win-acme.com/manual/validation-problems

Add this record to your DNS server to allow Let's Encrypt to issue certificates for your domain.

```dns
example.com. CAA 0 issue "letsencrypt.org"
```

--------------------------------

### Unattended Certificate Renewal for Apache

Source: https://www.win-acme.com/manual/advanced-use/examples/apache

Use this command for unattended certificate renewal when storing certificates in PEM format for Apache. Ensure the webroot path is correctly specified.

```bash
wacs.exe --source manual --host www.example.com --validation filesystem --webroot "C:\htdocs\www\example.com" --store pemfiles --pemfilespath C:\apache-certs
```

--------------------------------

### Add Process ID to File Log Output

Source: https://www.win-acme.com/manual/advanced-use/custom-logging

This JSON configuration snippet adds the process ID to the output template for file logging.

```json
{
	"disk": {
		"WriteTo": [
			{
				"Name": "File",
				"Args": {
					"outputTemplate": "{Timestamp:yyyy-MM-dd HH:mm:ss.fff zzz} [{Level:u3}] [PID:{ProcessId}] {Message:lj}{NewLine}{Exception}"
				}
			}
		]
	}
}
```

--------------------------------

### URL Rewrite Exception for ACME Challenges

Source: https://www.win-acme.com/manual/validation-problems

Configure URL Rewrite to bypass challenges for the .well-known/acme-challenge/ path. This rule ensures that Let's Encrypt validation requests are not intercepted by URL Rewrite rules.

```xml
<rule name="LetsEncrypt Rule" stopProcessing="true">
    <match url="^\.well-known/acme-challenge/.*$" />
    <action type="None" />
</rule>

```
Tokens:
Raw