SSL Renewal Check

Server software · checked November 15, 2026

Is Windows IIS (manual) ready for 100-day and 47-day certificates?

Manual: you renew it

Not on its own. With Windows IIS (manual), each new certificate has to be obtained and installed, either by you or by an ACME client you set up. From March 15, 2027 that’s at least every 100 days.

What renews automatically

  • IIS 8.5+ Certificate Rebind automatically rebinds a site to a renewed certificate. It doesn't obtain the certificate.[Microsoft]
  • With win-acme (a third-party ACME client), a daily scheduled task renews by default 55 days after issue, follows the CA's ARI suggestions unless disabled, and renews anyway when fewer than 7 days remain.[win-acme 1, 2]

What doesn’t

  • Without an ACME client, each new certificate has to be requested, installed and bound by hand.[Microsoft]

When it renews

win-acme: RenewalDays = 55 days after issue (default).[win-acme]

Check win-acme without ARI: 55 days is longer than a 45-day certificate

win-acme renews by default 55 days after issue (RenewalDays). It follows the CA’s ARI suggestions unless RenewalDisableServerSchedule is set to true, and renews anyway with fewer than 7 days left. If you turned ARI off, lower RenewalDays to about two-thirds of the lifetime before 45-day Let’s Encrypt certificates arrive on February 16, 2028.[win-acme 1, 2; Let's Encrypt]

What to do, and by when

  1. March 15, 2027 · In 120 days
    Maximum certificate lifetime drops to 100 days[CA/Browser Forum 1, 2]
    If you install purchased certificates by hand, move to an ACME client before your first renewal after this date.
  2. February 16, 2028 · In 458 days
    Let's Encrypt default certificates drop to 45 days[Let's Encrypt 1, 2]
    If you use win-acme with ARI disabled (RenewalDisableServerSchedule = true), lower RenewalDays below 30 before 45-day certificates arrive.

Steps

  1. List your IIS bindings and note which certificates were installed by hand.
  2. Install an ACME client such as win-acme and let it create its scheduled task.
  3. Keep ARI on (the win-acme default). If you turned it off, set RenewalDays to about two-thirds of the certificate lifetime.
  4. Enable Certificate Rebind in IIS Manager > Server Certificates if renewed certificates aren't picked up.

Your options, free first

  1. Free: use a free ACME client with Let’s Encrypt (for example win-acme on Windows, or Certbot, Apache mod_md or nginx’s ACME module on Linux) so certificates renew and install themselves.
  2. An automated paid certificate, if you need a paid one (for example OV/EV): choose a seller whose certificates install themselves (ACME or an install agent).
    • Namecheap SSL (with SSL Manager / SSL Proxy automation)[Namecheap]
  3. A host with built-in automatic SSL, if your current host can’t automate:
    • Hostinger (free Lifetime SSL on web, cloud and agency plans)[Hostinger]

No links here are paid. If that ever changes, they will be marked “Sponsored” and never change the order. Disclosure.

Not published by Windows IIS (manual)

  • Whether newer IIS versions include a public-CA ACME client: we found nothing in Microsoft's IIS documentation.

We re-check these every month.

Questions

Does IIS renew SSL certificates automatically?

Not by itself. Certificate Rebind only rebinds a certificate that has already been renewed by something else.

Is win-acme's 55-day default safe for 45-day certificates?

Only with its safeguards: ARI is on by default and it renews anyway with fewer than 7 days left. With ARI turned off, 55 days is longer than a 45-day certificate lasts.

Sources

Facts on this page last checked November 15, 2026.