Certificates - CertiNext - How to Configure Certificate Renewal on Windows Server IIS Using Simple-ACME

1. Download Simple-ACME from: https://simple-acme.com/
2. Extract or copy the application files to a permanent folder on the server that will be responsible for certificate renewal.
   Example: C:\Tools\Simple-ACME
   Important: Do not place the application in a temporary folder, as scheduled renewals depend on this location

Important:
- Before launching Simple-ACME for the first time, update settings_default.json to use the CertiNext ACME endpoint.
- During its initial launch, Simple-ACME automatically creates settings.json using the values defined in settings_default.json.
- After settings.json has been created, future configuration changes should be made in settings.json, as it becomes the active configuration file used by Simple-ACME.
- This url provides information on the settings.json:  https://simple-acme.com/reference/settings

1. Open file settings_default.json located in the Simple-ACME installation directory.
2. Locate the Acme section.
   1. Modify the URLs as shown below:
      { "Acme": {
      "DefaultBaseUri": "https://acme-us.certinext.io/v1/directory",
      "DefaultBaseUriTest": "https://acme-us.certinext.io/v1/directory",
      "DefaultBaseUriImport": "https://acme-us.certinext.io/v1/directory",
      Example:
      
3. Locate the ScheduledTask section.
   1. Set the RenewalDays to desired days.
      Important:  RenewalDays is not the number of days before expiration. It represents the certificate age, in days, at which Simple-ACME considers the certificate eligible for renewal. For a 30-day certificate, a value of 20 causes renewal attempts to begin approximately 10 days before expiration. This aligns with observed CertiNext renewal behavior and provides time to identify and correct renewal issues before certificate expiration.
   2. Set other settings as desired.
      Example:
4. Locate the Notification section.
   1. Configure the SmtpServer to "lsmtp.okstate.edu".
   2. Configure the SenderName as desired.
   3. Configure the SenderAddress as desired.
   4. Configure the ReceiverAddresses as desired.
   5. Configure the NotifyOnSuccess to true.
      Example:
      
5. Save the file and close.
    

1. Right-click wacs.exe.
2. Select Run as administrator.
3. When the application starts, verify that the startup message displays: Connecting to https://acme-us.certinext.io/v1/directory...
   
4. If another ACME provider is displayed:
   1. Close the application.
   2. Verify the changes were saved to settings.json.
   3. Relaunch the application.

1. Continuing in Simple-ACME.
2. From the main menu, select M: Create certificate (full options). This mode runs in Interactive, Advanced mode.
   Note: This article uses the Full Options (M:) workflow to provide access to all available configuration options. The default settings workflow (N:) is designed for users who want to install a standard (non-wildcard) certificate on an IIS web server running on the same machine and provides fewer configuration options.
   
3. When prompted for How shall we determine the domain(s) to include in the certificate, select the appropriate option.
   Example: Selected 1: Read Bindings from IIS​​
4. When prompted for Site identifier(s), select the appropriate option.
   Example: Selected 2 showing single website
5. When prompted for Binding identifiers(s), select the appropriate option.
   Example: Selected A
   
6. When prompted to Continue with selection, select the appropriate option.
   Example: Entered y
   
7. When prompted for Friendly name, accept or enter a name.
   Example: Entered to accept

1. Continuing in Simple-ACME.
2. When prompted for Would you like to split this source into multiple certificates, select the appropriate option.
   Example: Selected 4: Single Certificate
3. When prompted for How would you like prove ownership for the domain, select the appropriate option.
   Example: Selected 1: [http] Let simple-acme answer HTTP validation request
4. When prompted for What kind of private key should be used for the certificate, select the appropriate option.
   1. Use EC if:
      1. All clients and servers are modern.
      2. This is for a new web server, API, appliance, or internal service.
      3. You want better performance with smaller keys.
   2. Use RSA if:
      1. You need maximum compatibility with older devices, applications, load balancers, or network equipment.
      2. Vendor documentation specifically requires RSA.
      3. You're unsure of client compatibility.
         
         Example: Selected 2: Generate an RSA public/private key pair​​​​​
5. When prompted for How would you like to store the certificate, select the appropriate option.
   1. Based on selection option of Windows Certificate Store (Local Computer), when prompted for Choose store to use, select the appropriate option.
      Example: Selected 3: [Default] - Use global default, currently WebHosting
6. Example: Selected 2: Add to Windows Certificate Store (Local Computer)
7. When prompted for Would you like to store it in another way too, select the appropriate option.
   Example: Selected 6:  No (additional) store steps
   
8. When prompted for Which installation step should run first, select the appropriate option.
   Example: Selected 1:  Create or update bindings in IIS
   
9. When prompted for Create new bindings in a different site, select the appropriate option.
   Example: Entered n 
10. When prompted for Add another installation step, select the appropriate option.
    Example: Selected 3: No (additional) installation steps
11. When prompted for Certificate profile to use:, select the appropriate option.
    Example: Selected 1: Unspecified (fallback to default in setting)
12. When prompted for how to open Terms of service Open in default application, select the appropriate option.
    Example: Entered y
    
13. When prompted for Do you agree with the terms, select the appropriate option.
    Example: Entered y
    
    
14. Review the Terms of service and close.
15. Proceed if Terms of service are agreeable.

1. Continuing in Simple-ACME.
2. When prompted for Key identifier, enter the Key ID from the CertiNext ACME API Credential.
   Example: Entered Key ID
3. When prompted for Key (base64url encoded), enter the Mac Key from the CertiNext ACME API Credential.
   Example: Entered Mac Key
   
4. When prompted for Email(s), enter the appropriate option.
   Example: Entered <Enter>
   
5. After entering the CertiNext ACME API credential and email address, Simple-ACME automatically completes the ACME account registration and certificate enrollment process.
   1. Creates a new ACME account.
   2. Generates the certificate source from the selected IIS binding.
   3. Creates the certificate order.
   4. Validates domain ownership and completes authorization.
   5. Downloads the issued certificate.
   6. Stores the certificate in the Windows Certificate Store.
   7. Grants the appropriate permissions to the certificate private key.
   8. Updates the existing IIS HTTPS binding.
   9. Commits the HTTPS binding changes to IIS.
   10. Creates a scheduled task for automatic certificate renewal.

1. Continuing in Simple-ACME.
2. When prompted for Do you want to specify the user the task will run as, enter the appropriate option.
   Example: Entered n
   Note: Selecting N configures the scheduled task to run under the System account.
3. After completing this step, Simple-ACME returns to the main menu.

1. Open Certificates (Local Computer)
   1.  Verify the certificate was installed in the expected Certificate Store.
   2. Verify the following certificate details.
      1. Subject CN: Matches the CertiNext CN (FQDN).
      2. Valid To: Matches the CertiNext Expires On.
      3. Public Key (Size): Matches the CertiNext Key Size (for example, 3072).
      4. Public Key (Algorithm): Matches the CertiNext Key Algorithm (for example, RSA or ECC).
      5. Serial Number: Matches the CertiNext Certificate Serial No. 
         1. Note: Windows may display a leading 00 at the beginning of the serial number. When comparing serial numbers, ignore the leading 00 if it is present.
2. Open Internet Information Services (IIS) Manager.
   1. Verify the HTTPS binding is using the newly issued certificate.
3. Browse to the website using HTTPS.
   1. Verify the website loads successfully without certificate warnings.
   2. View the certificate presented by the website in the browser and verify the Subject and Expiration Date match the newly issued certificate.

1. Open Task Scheduler.
2. Navigate to Task Scheduler Library.
3. Verify a task similar to the following exists: simple-acme renew (acme-us.certinext.iov1directory)
4. Verify the task status is Ready.
5. If changes to the renewal schedule are required, right-click the task and select Properties to modify:
   1. Triggers (schedule and frequency)
   2. Conditions
   3. Settings
   4. User account used to run the task

Important:
- Any scheduling changes should be made directly in new settings.json file and in the Task Scheduler simple-acme task so they both match.
- Simple-Acme will only renew a certificate when it is within 10 days of its expiration date.
- Renewal notifications will be sent to the email address associated with the CertiNext ACME API Credential.  Two emails are received and no action is required:
Examples:
Order is Placed Successfully

Certificate is ready for download

1. How to Force a Certificate Renewal
   1. Open Command Prompt as Administrator.
   2. Change to the Simple-ACME installation directory.
      Example: cd C:\Tools\Simple-ACME
   3. Run the following command: wacs.exe --renew --force
      Note: This command forces Simple-ACME to process all configured renewals, even if they are not currently due for renewal.
       
2. How to Check Simple-Acme Logs
   1. Open File Explorer.
   2. Browse to the Simple-ACME log directory:
      Example: C:\ProgramData\simple-acme\acme-us.certinext.iov1directory\Log