IIS quick start¶

This page gets a trusted Let's Encrypt certificate onto an IIS site on a Windows server, renewed automatically from then on. Everything starts from the dashboard's Overview: click Get a certificate for a server. The page shows the steps in order, each with one next action, and ticks the finished ones. You need an account that can see install commands, approve agents and propose workflows (an Administrator, for example), and access to the DNS provider of the names on the certificate.

The dashboard only proposes the certificate; the server decides. A new installation of the Agent applies the proposals of its organization by itself, so there is nothing to approve on the server. On a server where that is switched off, a local administrator approves each proposal (see Dashboard-assigned workflows).

1. Install the Agent on Windows¶

Under 1 Connect the server, open Install the CertIntel Agent on the server and click Install on Windows. It opens your organization's install token page at Install on Windows. (Installing one server by hand? Mint a one-time install token in the same step instead: it is shown once with the same commands and enrolls exactly one server.)

On the server, open PowerShell with Run as administrator, then paste and run the command from Copy commands under PowerShell (elevated). Leave the Installation options as they are; the API base is already this deployment's address. The installer downloads and verifies the Agent, installs it and connects it to your workspace. It ends with:

Next: approve this computer (WEB01) on the Agents page of your CertIntel dashboard:
  https://app.certin.tel/all-hosts
Until then it is "pending approval": it cannot report or receive certificates.
Then choose "Get a certificate for a server" on the dashboard Overview.

On another CertIntel deployment the first line points at the dashboard that gave you the install command and names the address the server connects to.

See Windows Agent for the installer's options and checks.

2. Approve it¶

Back on Get a certificate for a server, the server appears under 2 Approve it within a few seconds of the command finishing. Click Approve next to it: one click, and the server can report to the workspace and receive proposals. (The Agents page, and the Needs attention list on the Overview, offer the same button; the Agents page asks for confirmation.)

3. Wait for its first report¶

An approved Agent reports the server types it can set up, usually within 2 minutes of its approval. The step says what it is waiting for and when the server was approved; there is nothing to do meanwhile. While a server approved in the last half hour has not reported, the page checks again by itself every 15 seconds. If it takes longer, restart the CertIntel Agent service on the server: it then reports at once.

4. Choose IIS, the site and the names¶

Under 4 Choose what the server runs and the names, choose the server and click Continue. On a Windows server IIS HTTPS binding is offered first. When the Agent reported an IIS site it detected on port 443, the page starts from it (Detected on this server: …): the server type and the names are filled in, and you can change them. When it reported several, a Detected on this server menu lists them: choose the site and click Use this. A site in another certificate store than Web Hosting, or on another port, opens the full workflow form filled in from it; a site that already has a workflow cannot be chosen (see Detected servers).

The certificate binds on port 443 with the first name as its hostname, and the Agent checks afterwards that the site serves it. Click Continue: CertIntel creates the organization's ACME account (if it has none for that certificate authority) and one Delegated DNS-01 record per name. Nothing is sent to the server yet.

5. Add the DNS record and check it¶

Under 5 Add the DNS record and check it, the page shows one CNAME per name, with copy buttons:

Add it once at your DNS provider. It lets the certificate authority check that you control the name, now and at every renewal; nothing else in your DNS changes. On Cloudflare, set the record to DNS only. Most DNS providers publish a new record within a minute or two. Check DNS is optional: it shows each record as Found or Not yet with what the name points at, and the next step checks the record anyway before it proposes.

6. Propose the certificate¶

6 Prepare the server and propose the certificate first says what the server must already have: the IIS site. The Agent reports the server's IIS sites, so the page shows Found for the site you chose, or Not found with the sites the server does report. The Agent binds the certificate to a site that exists and creates none; create a missing site in IIS Manager and restart the CertIntel Agent service so it reports it.

Click Propose the certificate. CertIntel checks the DNS record first: if the CNAME is not visible yet, nothing is proposed and the step says so (The DNS-01 CNAME is not in place: …). Only if this page cannot see your DNS (a private DNS view, for example) tick Propose without checking DNS.

7. What happens on the server¶

The page now lists the rest in the order of the work. Every step that waits says what it waits for, the Agent's latest report or CertIntel's latest check with its age, and what to do.

A server that applies proposals by itself (the default of a new Agent installation) has no approval step: the page says Nothing to approve. The Agent fetches the proposal within 5 minutes (within a minute during its first 15 minutes after approval), requests the certificate and installs it.

A server that needs approval starts with 1 Approve the proposal on the server, in either of these ways:

• In the CertIntel Agent app: Overview → Dashboard assignments, select the proposal, Approve…, and confirm the administrator approval.
• In PowerShell opened with Run as administrator, with the command the page shows (the assignment ID and revision are filled in):

certintel assignments approve ASSIGNMENT-ID --revision 1

certintel assignments show ASSIGNMENT-ID shows the proposal first, and certintel assignments refresh fetches it now.

The steps after that are the same for both:

1. The agent gets the certificate. The Agent looks for the DNS record every 10 seconds for up to 5 minutes, then asks the certificate authority, which usually takes under a minute. If the request fails, for example because the DNS record is not visible yet, the step says so and when the Agent tries again by itself; nothing is proposed again. certintel certificates issue CERTIFICATE-ID on the server requests it now. As soon as the Agent reports the certificate issued, it is listed under Certificates, with Issued, not installed yet until it is installed.
2. Point IIS HTTPS binding at the certificate. There is nothing to configure in IIS: the Agent installs the certificate into the certificate store and binds it to the site.
3. The agent confirms that the site serves it. The Agent checks the site, and checks again every 30 seconds for about 15 minutes while the certificate is new on the server. The page checks again by itself until it says Done.

8. Renewed automatically¶

Renewal is not a step: from now on the Agent renews the certificate before it expires, installs it and updates the binding by itself. To get an email if a renewal ever fails, turn on Failed ACME renewals for a destination under Alert Settings. Get a certificate for another server starts again for the next one.

If something does not work¶

To set the certificate up on the server itself instead, use the desktop app's IIS HTTPS binding template; see Workflow studio & usage.