Certificate automation, explained.
Practical guides to SSL/TLS certificates on real servers: IIS and Windows, PFX files, shorter certificate lifetimes, and choosing the right tool.
Let’s Encrypt on IIS: free SSL certificates that renew themselves
How to use free Let’s Encrypt SSL certificates on IIS and Windows Server, with automatic renewal, binding updates and checks, for one server or a load-balanced pool.
Read the guide ↗How to automate PFX certificate renewal, password included
Renew PFX (PKCS#12) certificate files automatically: clear file names, per-certificate passwords, legacy 3DES for old Windows, bulk exports, network shares and API downloads.
Read the guide ↗47-day SSL certificates: what changes and how to prepare
SSL/TLS certificates are limited to 200 days now, 100 days from March 2027 and 47 days from March 2029. What it means for renewals and validation, and a checklist to prepare.
Read the guide ↗EverTLS vs Certify The Web vs win-acme
An honest comparison of three ways to automate SSL certificates on Windows and IIS: win-acme, Certify The Web and EverTLS. Prices, central management, Linux support and when to choose each.
Read the guide ↗IIS Centralized Certificate Store with Let’s Encrypt
Use Let’s Encrypt with IIS Centralized Certificate Store: how CCS file names work, setting up the share, and renewing PFX files automatically for a whole load-balanced IIS pool.
Read the guide ↗Wildcard SSL certificates on IIS with Let’s Encrypt
Get free Let’s Encrypt wildcard certificates on IIS and Windows Server: DNS validation with CNAME delegation or your DNS provider, automatic binding updates, and many sites on one certificate.
Read the guide ↗Wildcard certificates with DNS-01 validation
How the ACME DNS-01 challenge works for wildcard certificates, and three ways to automate it: a DNS provider API key, a key kept on your own server, or CNAME delegation with no key at all.
Read the guide ↗Let’s Encrypt alternatives: free ACME certificate authorities
Free alternatives and backups to Let’s Encrypt: Google Trust Services, ZeroSSL, SSL.com and Actalis compared. Wildcards, EAB setup, rate limits, and using a backup CA.
Read the guide ↗Certbot alternatives
Alternatives to Certbot for Let’s Encrypt certificates: acme.sh, lego, Caddy, Traefik, cert-manager and win-acme, and when to manage certificates centrally across many servers.
Read the guide ↗