HTTPS on Windows with IIS certificate using Let's Encrypt

In order to enable HTTPS for a website you need to get a certificate from a Certificate Authority (CA).
Most of the CA authorities offers paid certificates.

But Let's Enrcrypt is a free CA .

To be able to use free certificates from Let's Encrypt you need  to demonstrate that you are in control of the domain for which you want a certificate.
This is done using software which use ACME protocol.

How you can do this on windows machines running IIS :

• ACMESharp

           A Powershell library that provides access to many (but not yet all) commands of the ACME                API.

• letsencrypt-win-simple

          This is a ACME windows CLI client built in native .net and aims to be as simple as possible to           use.

• Certify - SSL Certificate Manager 

           Certify is a visual GUI based tool built on top of ACMESharp library.
It is still in alpha version , but is a promising tool.

The easiest to use , from my point of view , is letsencrypt-win-simple .

Why ?

Easy to install and easy to run .

Before running it make sure that you do the next in IIS :

1. Go to IIS manager and on the server select Handler Mappings , then View ordered list from the right menu .  Scroll down to find StaticFile handler and make sure it is above the Extensionless handlers, like in the bellow picture.

2. In case you have a custom  HTTP module running in IIS which is removing the Server header from the response , disable it while you are setting up the certificate and also when you are renewing it .

3. On the bindings of the web site for which the certificate is requested , make sure that the host name is filled in the binding settings section

After running the tool you will get the certificate in IIS .

Update : 21/03/20017

After you get the certificate you might wan to :

1. Revert StaticFile handler to it's original position .
    Why ? If you have an application under your website in iis,  which for example  is an web api , it      will no longer work until you revert the Staticfile handler to it's original position.

How to create a cer file from a pfx

If you want to extract client certificates, you can use OpenSSL's PKCS12 tool.

openssl pkcs12 -in input.pfx -out mycerts.crt -nokeys -clcerts

The command above will output certificate(s) in PEM format. The ".crt" file extension is handled by both macOS and Window.
You mention ".cer" extension in the question which is conventionally used for the DER encoded files. A binary encoding. Try the ".crt" file first and if it's not accepted, easy to convert from PEM to DER:


openssl x509 -inform pem -in mycerts.crt -outform der -out mycerts.cer

Cannot access site hosted on IIS from LAN with server firewall on - Windows 10

In order to allow access to websites hosted on IIS  on windows 10 from the same network do next:
1. Go to Windows Firewall
2. Select Advanced Settings
3. Select Inbound Rules
4.  Search for rule : BranchCache Content Retrieval (HTTP-In) 
5. Right click on it and enable