RymarisCerts IIS recorded automatic walkthrough This is a genuine scripted terminal/PowerShell session on an isolated demo server. All displayed operations were executed. No production certificates, passwords, MFA, or private-key contents are included. Lab .test hostnames and explicit-root checks must be replaced with your own hostnames and normal public trust in production. Passwords were supplied privately before recording. On your server enter package passwords locally;never put them into commands,source files,or website configuration. Silent waiting periods in this recording have been shortened;all shown operations were executed. 00:00:00.000 Chapter 1: Security: short lifetimes with automatic replacement 00:00:04.063 Chapter 2: Check the supported server and back up configuration 00:00:09.930 Chapter 3: Enroll the native client and IIS installer once 00:00:23.941 Chapter 4: Verify the certificate actually served 00:00:28.040 Chapter 5: Inspect and execute the native scheduled renewal 00:00:47.332 Chapter 6: Confirm scheduled replacement is installed 00:00:51.399 Chapter 7: Prove failure preserves the working certificate 00:01:07.495 Chapter 8: Restore connectivity and verify recovery RECORDED COMMANDS AND OUTPUT RymarisCerts | Native automatic IIS renewal CHAPTER 1 | Security: short lifetimes with automatic replacement Short lifetimes limit misuse after key theft or incorrect issuance. One-time administrator setup is required;automation replaces certificates before expiry. This real scripted session uses disposable one-hour certificates from a private CA. Silent waiting periods are shortened. Production uses normal public trust and actual DNS. RymarisCerts | Native automatic IIS renewal CHAPTER 2 | Check the supported server and back up configuration Name Installed ---- --------- Web-Server True Windows Server2025 / IIS10 isolated lab. Existing sites are preserved. RymarisCerts | Native automatic IIS renewal CHAPTER 3 | Enroll the native client and IIS installer once PS> wacs.exe --source iis ... --validation filesystem --store certificatestore --installation iis The lab uses a private ACME endpoint;use the public provider command in the written guide. Private account and certificate keys are not printed. A simple cross platform ACME client (WACS) Software version 2.4.1.2444 (release, pluggable, standalone, 64-bit) Connecting to https://127.0.0.1:14443/dir... Connection OK! Scheduled task is disabled Scheduled task exists but does not look healthy Check the manual at https://simple-acme.com Please leave a ★ at https://github.com/simple-acme/simple-acme Error updating public suffix list from https://publicsuffix.org/list/public_suffix_list.dat Running in mode: Unattended Source generated using plugin IIS bindings: auto.iis.rymariscerts.test Overwriting previously created renewal Using existing default ACME account: https://127.0.0.1:14443/my-account/1f9713b3c98496c0 Plugin IIS bindings generated source auto.iis.rymariscerts.test with 1 identifiers Plugin Single created 1 order Renewing RymarisCerts-Automatic-IIS-Lab [auto.iis.rymariscerts.test] Authorizing... [auto.iis.rymariscerts.test] Authorizing using http-01 validation (Filesystem) Answer should now be browsable at http://auto.iis.rymariscerts.test/.well-known/acme-challenge/feHMFSVsv7ZvJc4XfxKl5vVANmYafBUJjEPsuT6kcYE Preliminary validation looks good, but the ACME server will be more thorough [auto.iis.rymariscerts.test] Authorization result: valid Downloading certificate RymarisCerts-Automatic-IIS-Lab Store with Windows Certificate Store... Installing certificate in the certificate store Adding certificate RymarisCerts-Automatic-IIS-Lab @ 2026/11/13 in store My Add FullControl rights for BUILTIN\Administrators Installing with Manage IIS bindings... Updating existing binding 127.0.0.1:443:auto.iis.rymariscerts.test (site:3, flags:Sni) Committing 1 https binding changes to IIS Scheduled task is disabled Scheduled task exists but does not look healthy Proceeding with unhealthy scheduled task, automatic renewals may not work until this is addressed Next renewal due after 2026/11/12 Certificate RymarisCerts-Automatic-IIS-Lab created RymarisCerts | Native automatic IIS renewal CHAPTER 4 | Verify the certificate actually served Thumbprint : 3FFE796DBCE6FFF3F47045499C4DE71B687EDC46 FingerprintSha256 : 0EE96476A5D2707973F32BC8F5498E441E454E07CFBEDA1408CBDA4A95595139 NotAfterUtc : 2026-11-13 21:43:42Z RymarisCerts | Native automatic IIS renewal CHAPTER 5 | Inspect and execute the native scheduled renewal A simple cross platform ACME client (WACS) Software version 2.4.1.2444 (release, pluggable, standalone, 64-bit) Connecting to https://127.0.0.1:14443/dir... Connection OK! Scheduled task is disabled Scheduled task exists but does not look healthy Check the manual at https://simple-acme.com Please leave a ★ at https://github.com/simple-acme/simple-acme Error updating public suffix list from https://publicsuffix.org/list/public_suffix_list.dat Deleting existing task RymarisCerts-Lab-WinAcme renew (127.0.0.114443dir) from Windows Task Scheduler. Adding Task Scheduler entry with the following settings - Name RymarisCerts-Lab-WinAcme renew (127.0.0.114443dir) - Path C:\RymarisCertsDemo\Automatic\WinAcme - Command wacs.exe --renew --baseuri "https://127.0.0.1:14443/dir" - Start at 09:00:00 - Time limit 02:00:00 Execute : C:\RymarisCertsDemo\Automatic\WinAcme\wacs.exe Arguments : --renew --baseuri "https://127.0.0.1:14443/dir" PS> Start-ScheduledTask -InputObject $ownedNativeTask Native scheduled task finished with result 0 RymarisCerts | Native automatic IIS renewal CHAPTER 6 | Confirm scheduled replacement is installed Thumbprint : 8781DC8F111464046974560B7C2AE15DAAC0C14B FingerprintSha256 : 0D5FF2E1F7E535C7F23AF117EE031BFB5699DD16E554C86A1159677C0564298A NotAfterUtc : 2026-11-13 21:44:06Z RymarisCerts | Native automatic IIS renewal CHAPTER 7 | Prove failure preserves the working certificate Controlled lab fault: stop only the owned loopback ACME relay. No public endpoint or other site changes. Native scheduled task finished with result 4294967295 Thumbprint : 8781DC8F111464046974560B7C2AE15DAAC0C14B FingerprintSha256 : 0D5FF2E1F7E535C7F23AF117EE031BFB5699DD16E554C86A1159677C0564298A NotAfterUtc : 2026-11-13 21:44:06Z RymarisCerts | Native automatic IIS renewal CHAPTER 8 | Restore connectivity and verify recovery Restart the owned loopback relay,then execute the same native scheduled action. Native scheduled task finished with result 4294967295 Private test CA rejected a nonce. Retrying the real scheduled action;nonce validation remains enabled. Native scheduled task finished with result 0 Thumbprint : 07B4C11B215A1715C68C88F1C785625A73C71D03 FingerprintSha256 : 6F274DEE56E9EA8B6A2A9D7F4008F812F6B86E2D92D51B970A85309B09E55460 NotAfterUtc : 2026-11-13 21:53:58Z Verified: new certificate served after scheduled recovery;exact SNI binding and control site preserved. Configure production failure monitoring before relying on automation. LAB HELPER NOTE Peer/fingerprint validate the live HTTPS name and chain using the explicit private lab root and report only public certificate details. The scheduled helper executes the real native renewal action. The temporary loopback connectivity fault is confined to this disposable lab. Production uses normal public trust and the provider endpoint in the written guide;never install the lab root or copy its endpoint to production. Private client account and certificate keys stay on the server and are never printed.