Skip to content

simple-acme and the Windows Agent

The Windows Agent and simple-acme are two ways to manage a certificate renewal. Choose one owner for each certificate:

  • Use an agent certificate workflow when the agent should create the ACME account, complete Delegated DNS-01, retain renewal state, issue the certificate, install it and renew it automatically.
  • Use simple-acme as the renewal owner with a wacs.exe configuration. Use CertIntel's reporting scripts to send its check-ins and renewal results to the platform.

Set up an Agent workflow

Create the certificate under Workflows → + New certificate workflow. Configure the template's destinations and studio steps, then complete certificate setup and its Delegated DNS-01 mapping. Configure one renewal owner for each certificate to avoid competing renewal or installation jobs.

Report simple-acme renewals to CertIntel

The reporting bundle contains three PowerShell scripts:

  • Checkin-Wrapper.ps1 replaces wacs.exe as the scheduled-task action and reports that the scheduled run started and completed;
  • Installation-Script.ps1 reports the newly issued certificate details from an additional simple-acme installation step; and
  • Notification-Script.ps1 reports the renewal outcome from simple-acme's global notification configuration.

Download the scripts and follow the bundled README on ACME check-ins and renewals. That integration posts directly to the CertIntel API using a write-scoped API key; it does not depend on the locally installed Windows Agent.

Use all three scripts. The installation report supplies certificate details, the notification supplies the outcome, and the wrapper records scheduled runs even when no certificate is due. Keep the same renewal identifier across the installation and notification reports so CertIntel can correlate them.

Warning

Do not put an API key directly in a command-line argument. Configure the scripts through their documented environment variables or protected deployment mechanism. Command lines and scheduled-task definitions are often visible to local administrators and inventory tools.

Delegated DNS-01 with simple-acme

Install the native CertIntel simple-acme plugin and select Create DNS-01 verification records in CertIntel. The DLL saves delegation settings and protected credentials through simple-acme and works without an installed Agent. Keep the three reporting scripts above if you want check-ins and renewal details as well as DNS validation.

Existing custom-script users can follow the migration instructions. There is also a separate win-acme DLL; the two builds are not interchangeable.

Avoid duplicate ownership

Do not leave automatic renewal enabled in both products for the same certificate. Duplicate owners can create unnecessary ACME orders, compete for DNS challenge values, overwrite deployment files, and make renewal history ambiguous. Reporting a simple-acme renewal to CertIntel does not transfer ownership to the agent; a native workflow does.