Simple-ACME (win-acme): complete Windows guide

Before starting simple-acme, you need to create EAB credentials in the FairSSL control panel. EAB (External Account Binding) links ACME certificates to your FairSSL account, so all certificates, clients and renewals are visible and monitored.

simple-acme.exe --register ^
  --baseuri https://fairssl.dk/acme/ ^
  --eab-key-identifier YOUR_KEY_ID ^
  --eab-key YOUR_HMAC_KEY ^
  --eab-algorithm HS256 ^
  --emailaddress your@email.com ^
  --accepttos

For automation and CI/CD, use CLI arguments instead of the interactive menu. Below are the most common scenarios.

IIS site with FairSSL AutoDNS

Wildcard + apex domain, validated via DNS-01 with FairSSL AutoDNS. No DNS API keys needed. --siteid 1 installs the certificate on IIS site 1 and automatically binds it to the hostnames in the site that match the certificate's names.

simple-acme.exe ^
  --baseuri https://fairssl.dk/acme/ ^
  --source manual ^
  --host "*.your-domain.com,your-domain.com" ^
  --validationmode dns-01 ^
  --validation acme-dns ^
  --csr ec ^
  --store certificatestore ^
  --installation iis ^
  --siteid 1 ^
  --accepttos

DNS validation with your own DNS provider and extra PEM + PFX (pluggable)

If you are not using AutoDNS and instead have direct API access to your DNS provider (requires the pluggable version). This example validates via Cloudflare API, stores the certificate in Windows Certificate Store, as PEM files and as PFX, and installs on IIS site 1:

simple-acme.exe ^
  --baseuri https://fairssl.dk/acme/ ^
  --source manual ^
  --host www.your-domain.com,your-domain.com ^
  --validationmode dns-01 ^
  --validation cloudflare ^
  --cloudflareapitoken YOUR_CF_TOKEN ^
  --csr ec ^
  --store certificatestore,pemfiles,pfxfile ^
  --pemfilespath C:\certs\your-domain.com ^
  --pfxfilepath C:\certs\your-domain.com ^
  --pfxpassword PASSWORD ^
  --installation iis ^
  --siteid 1 ^
  --accepttos

Storage options (store)

Simple-acme can store certificates in multiple ways. Combine them with commas in --store.

--store certificatestore

--store pemfiles ^
--pemfilespath C:\certs\

--store pfxfile ^
--pfxfilepath C:\certs\ ^
--pfxpassword PASSWORD

Combine storage types: --store certificatestore,pemfiles saves to Windows Certificate Store and exports PEM files simultaneously.

Post-renewal script

Run a script after successful renewal, for example to activate the certificate on network equipment or restart a service:

simple-acme.exe ^
  --baseuri https://fairssl.dk/acme/ ^
  --source manual ^
  --host rdp.your-domain.com ^
  --validationmode dns-01 ^
  --validation acme-dns ^
  --csr ec ^
  --store pemfiles ^
  --pemfilespath C:\certs\rdp ^
  --installation script ^
  --script "C:\scripts\deploy-cert.ps1" ^
  --scriptparameters "'{CertThumbprint}' '{StoreType}'" ^
  --accepttos

Simple-acme supports RSA and ECDSA keys. The choice affects handshake speed, bandwidth and future-proofing.

Simple-acme defaults to P-384 for EC, which we recommend. If you need to change key type, it can be done via settings.json:

{
  "CSR": {
    "EC": {
      "CurveName": "secp384r1"
    }
  }
}

Simple-acme creates a Windows Task Scheduler task on the first certificate. The task runs daily and renews certificates approaching expiry.

Important: The scheduled task and settings.json must be in sync. Run time, random delay and paths must match in both places. If you change settings in one, the other must be updated accordingly. Mismatches between the two are one of the most common causes of silent renewal failures.

"ScheduledTask": {
  "StartBoundary": "05:00:00",
  "RandomDelay": "01:00:00"
}

Short certificate lifetime (47 days from 2029)

With 47-day certificate lifetimes from March 2029, renewal must run more frequently and reliably. Simple-acme with ARI handles this automatically. The CA determines the optimal renewal time, and the client follows it. We recommend testing your setup thoroughly now, while certificates still have 200-day lifetimes, so you are ready for the shorter lifetimes.