EverTLS vs Certify The Web vs win-acme
Three popular ways to automate certificates on Windows, built on different ideas: a free per-server client, a per-server app with a hub, and a central service with agents. Here’s how they compare and which fits when.
We make EverTLS, so read this with that in mind. We’ve kept to what each project says on its own website as of October 2026; check their pages for anything that matters to your decision.
Three different approaches
- win-acme is a free, open-source (Apache-2.0) ACME client for Windows, maintained by ZeroSSL. You run it on each server; it creates certificates for local IIS sites and sets up a scheduled task that renews them.
- Certify The Web (Certify Certificate Manager) is a Windows application with a graphical interface, with a management agent for Linux and macOS and a Management Hub for larger bundles. It’s free to evaluate; licences are sold per server per year.
- EverTLS is a central service (hosted, or self-hosted on Enterprise) with lightweight agents for Linux and Windows. You manage every certificate, server and team member from one dashboard; agents install renewals and verify them.
At a glance
| win-acme | Certify The Web | EverTLS | |
|---|---|---|---|
| What it is | Command-line client per Windows server | Windows app (GUI) per server; agent for Linux and macOS | Central dashboard + agents for Linux and Windows |
| Price | Free, open source | Free evaluation; from $59 a year for 1 server, $149 for up to 3, $649 for up to 50, $1,999 for up to 250 | Free for 2 certificates; Pro $29 a month (50 certificates), Business $149 a month (250) |
| Priced by | — | Server | Certificate (agents unlimited on paid plans) |
| Central view of many servers | No, per server | Management Hub, in bundles of 10+ servers | Yes, built in |
| IIS and the Windows certificate store | Yes | Yes | Yes |
| IIS Centralized Certificate Store | Yes (“IIS Central Store”) | See vendor | Yes |
| Linux web servers | No | Via the management agent | nginx, Apache, HAProxy, PEM and PFX files |
| DNS validation | Plugins for many providers | Many providers | 190+ providers, CNAME delegation, or a key kept on the agent |
| Team, roles, SSO, audit log | No | See vendor | Yes (SSO on Business) |
| Alerts and monitoring | See vendor | Email, Slack, Teams, webhooks; endpoint monitoring |
Prices in US dollars as listed by each vendor in October 2026. “See vendor” means we couldn’t confirm it from their own pages.
Which one should you use?
win-acme
A great choice for a single Windows server and an administrator comfortable with the command line. It’s free and scriptable, and it does one job well. It gets harder to keep track of once you have many servers, since each one renews on its own and nobody sees the whole picture.
Certify The Web
Suits Windows administrators who want a graphical tool on each server, with per-server licences and a hub for bigger estates. If your servers are mostly Windows and you think in servers rather than certificates, it’s a natural fit.
EverTLS
Suits teams with many servers, or a mix of Linux and Windows, who want one place to see every certificate, alerts when something needs attention, and private keys that stay on their own servers. Agents are unlimited on paid plans, so the price follows the certificates you manage, not how many servers they’re on. Agent groups and IIS Centralized Certificate Store support handle load-balanced IIS pools, and a backup certificate authority keeps renewals going when one has an outage.
Moving to EverTLS
You don’t have to switch everything at once. Install an agent on a server, let it discover the existing sites, and choose Manage with EverTLS site by site; the old client can keep running until you remove it.