About the UW-Acme certificate renewal service

How UW-Acme works

UW-Acme is a certificate renewal service that automatically renews and deploys TLS certificates using the ACME protocol. It installs certificates in the Windows Certificate Store and automatically updates IIS bindings associated with a UW-Acme-managed certificate. UW-Acme also detects additional IIS bindings that use the managed certificate and updates them during future renewals.

Requirements and important notes

• The Posh-ACME and IISAdministration PowerShell modules will be installed on the server and are required for certificate management and should not be removed.

• PowerShell remoting must remain enabled on the server. Disabling PowerShell remoting may prevent certificate renewals and deployment activities from succeeding.

• Certificates used outside of IIS may require additional configuration or a separate manual update process.

• Application owners remain responsible for ensuring their applications continue to function correctly following a certificate renewal.

• Currently only public certificates are supported by UW-ACME. Private certificate functionality is in scope for future versions.

Certificate storage locations

Onboarding information required

Before a server is onboarded to UW-Acme, ntmaint must confirm the certificate and deployment details with the application owner.

• Server FQDN: The fully qualified domain name of the server being onboarded.

• Certificate Subject: The primary subject name for the certificate.

• Subject Alternative Names: Any additional names that must be included on the certificate.

• PFX Password: The assigned password for the certificate file, if applicable.

• IIS Binding Management: Whether IIS bindings should be managed automatically by UW-Acme.

• Non-IIS Usage: Whether the certificate is used by any service or application other than IIS.

• Special Deployment Requirements: Any application-specific renewal, deployment, or validation requirements.

Alternative deployment options

If automatic IIS binding management is not appropriate for an application, UW-Acme can be configured to renew the certificate without modifying IIS bindings. In this configuration, the renewed certificate files are placed on disk and the application owner is responsible for deploying them using their own process.

What to expect during onboarding

Application Administrators will be contacted directly with onboarding details as their current certificates approach expiry. This outreach will include the information required to transition the certificate to UW-Acme and any application-specific details that need to be confirmed before onboarding can proceed.