win-acme renewal failed on Windows IIS

win-acme renewal failed when IIS validation or scheduled task cannot update the certificate store binding. Attach WACS log excerpts to every ticket and note the certificate thumbprint IIS should bind after a successful run.

When this happens

Scheduled task last result non-zero in Task Scheduler. Group Policy pushes expired intermediate trust stores on domain-joined servers running WACS with public issuers.

HTTP challenge blocked by URL Rewrite or ARR on farm nodes. HTTP to HTTPS redirects at site level can break HTTP-01 if not scoped per binding. Gallery-based IIS images reset URL Rewrite rules that WACS depended on for HTTP-01 during quarterly image refreshes.

First response

win-acme renewal failed on IIS—Task Scheduler runs, HTTP-01 reachability, and certificate store binding updates.

Searches for win-acme renewal failed usually mean automated renewal failed, succeeded locally but never reached the TLS listener, or hit Let's Encrypt rate limits. The fix is almost always permissions, challenge reachability, or a missing reload—not buying a longer-lived commercial cert as the first move.

For win-acme renewal failed on Windows IIS, read the ACME or panel error verbatim, run a dry-run renewal if your stack supports it, then confirm what certificate strangers receive on port 443 after you deploy. Certificate files on disk lie; only live handshakes matter for users.

win-acme (WACS) schedules through Windows Task Scheduler and stores binding updates in IIS or netsh. Renewal failed in the UI usually means validation could not reach :80 on the binding or permissions blocked certificate store update. Check Application event log alongside wacs log in %programdata%. Triage should capture timestamps, account URLs, and the last Boulder error type before infrastructure changes widen blast radius. Pause destructive retries until you can cite the last Boulder error type and the challenge mechanism in use; random package reinstalls rarely fix presentation gaps.

See also ACME DNS-01 challenge propagation delays and ACME HTTP-01 challenge failed 403.

Why renewal failed

WACS validates then installs via plugins matching IIS bindings. Document binding order when multiple sites share IP:443; validation host header must match the site WACS selected in the renewal wizard. Windows farms need the same post-renew serial verification as Linux fleets.

Task must run as account with rights to machine store and private key. After Windows updates, verify the scheduled task principal still has Log on as a batch job right—hardening baselines sometimes strip it silently. URL Rewrite and ARR rules should be audited whenever HTTP-01 starts failing.

Central Certificate Store farms need consistent thumbprint updates. IIS centralized certificate store renewals need coordinated thumbprint updates on all nodes. Escalate with timestamps, hostnames, and serial comparisons attached so the next engineer does not repeat already-failed renew attempts.

win-acme combines ACME client with installation plugins for IIS, Central Certificate Store, or script hooks. Failed renew leaves binding thumbprint pointing at expired cert in local machine store. Clarify in tickets whether failure is validation, issuance, deploy, or listener presentment—teams too often mix these phases when reading logs. Windows farms deserve the same serial verification rigor as Linux; Task Scheduler success without binding updates is a silent failure mode.

Not fixed by reboot alone; task must succeed and update binding. IIS displays confusing multi-site binding UIs; WACS logs remain the authoritative narrative when Event Viewer only shows generic Schannel warnings.

Common causes

These patterns drive most win-acme renewal failed tickets. They explain why automation logs look green while browsers or APIs still break.

URL Rewrite blocked .well-known. HTTP.sys URL reservations left by deleted sites can steal port 80 responses for challenge host headers still reserved.

ARR farm renewed only one node.

Task runs as account without private key permission. Shared hosting user cannot write webroot while task runs as SYSTEM—validation file never created.

Diagnose

Open latest WACS log and correlate Boulder error with site binding.

Get-ScheduledTask -TaskName '*win-acme*' | Get-ScheduledTaskInfo
Get-ChildItem "$env:ProgramData\win-acme\log" | Sort LastWriteTime -Desc | Select -First 1

Open latest wacs log; match Boulder error to binding host header; test HTTP challenge locally with curl localhost. Include PowerShell Get-WebBinding table in ticket showing host header, port, and certificate hash. Export IIS Get-WebSite bindings alongside WACS renewal logs so host header mismatches are obvious.

Fix step-by-step

Follow this sequence for win-acme renewal failed on windows iis. Capture command output after each step so the next responder can pick up without rerunning destructive changes.

1. Read newest WACS log for validation vs install phase.
2. Ensure HTTP-01 reachable on binding host header.
3. Fix URL Rewrite rules blocking dot paths.
4. Run WACS interactive test renew.
5. Verify scheduled task enabled and credentials valid.
6. Confirm IIS binding shows new thumbprint.
7. External openssl customer hostname.
8. Export task last run to monitoring.
9. Archive redacted ACME logs and openssl transcripts in the ticket before closing.
10. Schedule a follow-up dry-run before the next natural renewal window.
11. Attach Task Scheduler last run result and WACS thumbprint after fix.

Verify the live certificate

OpenSSL

echo | openssl s_client -connect HOST:443 -servername HOST 2>/dev/null | openssl x509 -noout -dates -subject -issuer

Replace HOST with the public hostname on the certificate. Run the same command after any reload or deploy change; acceptance means notAfter moved forward and serial changed versus the incident-opening capture.

How to read the output

External openssl customer domain; compare cert thumbprint in IIS manager.

curl

curl -vI --connect-timeout 10 https://HOST/ 2>&1 | grep -Ei 'expire|SSL certificate|subject:|issuer:'

Replace HOST with the public hostname users request.

Roll out and verify

Run wacs interactively with test validation.

Fix site binding; ensure task enabled after updates. Validate new thumbprint on all IIS nodes in web farm before removing old cert from LocalMachine store. Farm nodes must share the same validation binding answer; ARR quirks often require centralized validation or DNS-01 on a dedicated host.

Monitor scheduled task last result code. Publish a short post-incident note listing which hop served stale TLS and which command proved the fix so the next renewal inherits a checklist.

What to automate

Alert on scheduled task failures and approaching notAfter on IIS sites. Export scheduled task last run and result codes into monitoring.

ssldays external checks catch binding drift win-acme thought it fixed. ssldays validates IIS sites the way external shoppers reach them. ssldays confirms IIS sites present renewed certificates to external clients, not only local certificate store views.