Renewing of certificates about win-acme

[Bryan-Legend]

It updates the existing bindings to use the new certificate. Didn't know there was a renewal thing in IIS.

[rdolezel]

It's IIS 8.5+ feature only (ie. W2012R2+).
http://www.iis.net/learn/get-started/whats-new-in-iis-85/certificate-rebind-in-iis85
The implementation is quite weird:
"When you enable Certificate Rebind, IIS registers a task in the system’s Task Scheduler, and the task is keyed to trigger upon a certificate-renewal event (event ID 1001). When such an event occurs (either when you manually renew the certificate, or when it renews through autoenrollment), the scheduled task executes the IIS command-line tool appcmd.exe. It gives appcmd the thumbprint of the expired certificate and the thumbprint of the new one. Using these two parameters, appcmd locates the Web sites that the old certificate is bound to, unbinds that certificate, and then binds the new certificate to them. If you set up your certificates to renew automatically through autoenrollment, and you enable Certificate Rebind, the whole process will be automated."
I would personally prefer the current rebinding system. Based on my experience it's not necessary to restart website or recycle application pool after replacing website certificate in HTTPS binding(s). It works immediately, for IIS, for Exchange too.

[Tasteful]

Sounds that is doing more or less the same the the letsencrypt client application is doing.

Other option that I have found is CCS (Central Certificate Store) that probably is easy and good for loadbalanced environment.

https://technet.microsoft.com/en-us/magazine/jj937171.aspx
http://blogs.msdn.com/b/kaushal/archive/2012/10/11/central-certificate-store-ccs-with-iis-8-windows-server-2012.aspx

[rdolezel]

Don't forget the name of this project - there is "simple" word in it :) In my opinion, for CCS it makes more sense to invest time into ACMESharp. This combination could create pretty robust platform with a centralized certificate repository.

[rkerber]

Central SSL was added in pull #33.

I have noticed that for central SSL when you update the certificate it takes time for IIS to realize that there is a new certificate. It is faster at switching the certificates when you switch them on the binding and don't used central SSL.