Managing SSL certificates manually on Windows can be tedious, especially when dealing with DNS challenges and frequent renewals. Since Certbot ceased native Windows support and acme.sh requires a Bash environment, Windows administrators need reliable, native alternatives for managing Let's Encrypt certificates.

Using Posh-ACME for Certificate Automation

Posh-ACME is a lightweight PowerShell-based solution for interacting with ACME-compliant certificate authorities. It is highly scriptable, making it an excellent choice for headless servers.

To begin, install the module via PowerShell:

Install-Module -Name Posh-ACME -Scope CurrentUser

Once installed, initialize you're ACME account by registering an email address and accepting the terms of service:

New-PAAccount -Contact 'your-email@example.com' -AcceptTOS

For domain verification, you typically need to use a DNS provider plugin. If you are using DNSPod (Tencent Cloud), you will need your API ID and Secret from the provider's security credantials dashboard. You can issue a certificate using the following structure:

$dnsCredentials = @{
   TencentKeyId = 'YOUR_API_ID'
   TencentSecret = (Read-Host 'Enter API Secret' -AsSecureString)
}

New-PACertificate -Domain 'api.example.com' -Plugin 'TencentDNS' -PluginArgs $dnsCredentials

Note that the New-PACertificate command may appear to hang while it interacts with the ACME server to perform the DNS challenge and request validation. Once completed, you can verify the status and location of your generated certificates:

Get-PACertificate | Select-Object -Property CertificatePath, KeyPath

Alternative Windows ACME Clients

While Posh-ACME is powerful for those comfortable with PowerShell scripting, it lacks a graphical user interface (GUI). For environments requiring better integration with IIS or an automated background service, consider the following tools:

• Certify The Web: A full-featured GUI application that excels at managing certificates for IIS and other web services. It provides a user-friendly dashboard for tracking expiration and renewal history.
• win-acme: A robust, CLI-based tool specifically designed for Windows. It provides "auto" mode, which can automatically scan IIS bindings and configure certificate renewals with out requiring complex scripts.

For long-term production use, ensure your chosen tool is configured to run as a scheduled task or a Windows service to handle the automatic 90-day renewal cycle, preventing unplanned downtime due to expired certificates.