Bridge SSL
Certbot on Windows: support status and what to use instead
Certbot's own instructions page for Windows says that Certbot has discontinued support for Windows [1]. If you run a Windows server and want Let's Encrypt certificates, plan around another ACME client: a Windows-native one, or Certbot inside WSL2 [2]. This page sets out what the Certbot team said, which routes its announcement and the clients' own documentation describe, and what to do when Certbot is already installed. The protocol underneath, ACME (RFC 8555), is explained in the ACME overview [7].
- Status
- The Windows page of Certbot's instructions states that Certbot has discontinued support for Windows [1]
- Installer
- The Certbot team announced that one release would be its last for the Windows Installer [2]
- Reason given
- Windows support was classed as Beta and depended on the capacity of the core team [2]
- Routes named
- Certify Certificate Manager, win-acme, and WSL2 with the Certbot Snap distribution [2]
- Install guide
- The system requirements line of the Certbot install guide reads "Linux, macOS, BSD and Windows" [3]
What Certbot says about Windows
Two Certbot sources address Windows support directly. Under "Windows installation procedure", the instructions page for Windows carries this notice: Certbot has discontinued support for Windows, with a pointer to a community announcement for alternatives [1].
That announcement, written for Windows users who get certificates from Let's Encrypt, gives the reasoning. How the authority works is covered in Let's Encrypt and ACME. Windows support was classed as Beta, and its level varied with the core team's capacity to improve the Windows installer and fix its problems [2]. Keeping the installer would have meant shipping one with issues that could take the team significant time to address, so the team decided against it [2].
The documents do not all agree. The Certbot install guide lists "Linux, macOS, BSD and Windows" under system requirements [3]. Because the two disagree, a new Windows deployment should not rest on that line alone.
What to use instead on a Windows server
The announcement names three routes [2]. Each client's own documentation says what it does on Windows, and the table keeps to those statements.
| Option | Class | What its documentation says |
|---|---|---|
| win-acme | Windows-native ACME client | An ACMEv2 client for Windows; creates and installs certificates on a local IIS server; creates a scheduled task to renew them; stores certificates in places that include Windows, the IIS Central Store, .pem files and a .pfx file [4] |
| Certify Certificate Manager | Certificate manager for Windows Server | A desktop UI plus a background management service; automated ACME renewals; direct integration with IIS on Windows [5] |
| Posh-ACME | PowerShell module and ACME client | Creates publicly trusted certificates from an ACME-capable certificate authority such as Let's Encrypt [6] |
| Certbot in WSL2 | The Certbot Snap distribution, run inside WSL2 | The announcement notes that systemd is officially supported in WSL2 and calls this a possible route [2] |
These are examples of classes, not a ranking. How to weigh a managed desktop tool against a script-based or Linux-side client is covered in choosing an ACME client by class.
If Certbot is already running on Windows
The announcement expects people to move. Where the web server was configured by hand, you obtain new certificates with the replacement software and then update the paths in the web server configuration, because the certificates are no longer the ones Certbot manages [2]. Where the replacement configures the web server itself, which the announcement says the options support in most cases, the second step may not be needed [2]. For IIS, both win-acme and Certify document support [4] [5].
One order for the move:
Note which certificate files the web server reads today.
Install the replacement client and request a new certificate for the same names.
Point the web server configuration at the new files, unless the client does it.
Check that renewal is scheduled before you remove Certbot.
Renewal is the part to confirm. win-acme documents a scheduled task for renewals [4] and Certify lists automated renewals [5]; the renewal side is treated in depth in ACME certificate renewal automation.
FAQ
Does Certbot work on Windows?
Certbot has discontinued support for Windows, according to the Windows page of its instructions. The Certbot install guide lists Windows among its system requirements, so the two pages differ. The instructions page and the announcement are the ones that address support.
Is there a Certbot download for Windows?
The Certbot instructions for Windows hold the discontinuation notice. The announcement says the release it describes would be the last for the Windows Installer.
Can I run Certbot on Windows through WSL2?
The announcement lists WSL2 with the Certbot Snap distribution as a route for Windows users and notes that systemd is officially supported in WSL2.
What can replace Certbot for IIS?
win-acme documents creating and installing certificates on a local IIS server, and Certify documents direct IIS integration on Windows. Both are ACME client tools, so the certificate comes from the same protocol. Steps for binding a certificate in IIS are outside this page.
Which ACME client works with Let's Encrypt on Windows?
The announcement that the Certbot instructions page points to lists Certify and win-acme for Windows users with Let's Encrypt certificates. win-acme describes itself as an ACMEv2 client for Windows, and Posh-ACME names Let's Encrypt as an example of an authority it can use.
Sources
Certbot, Instructions for Other on Windows: certbot.eff.org/instructions?ws=other&os=windows.
Let's Encrypt community forum, Certbot announcement on discontinuing Windows beta support: community.letsencrypt.org/t/certbot-discontinuing-windows-beta-support-in-2024/208101.
Certbot documentation, Installation, System Requirements: github.com/certbot/certbot, file certbot/docs/install.rst.
win-acme, home page: www.win-acme.com.
Certify The Web Docs, documentation overview: docs.certifytheweb.com.
Posh-ACME documentation, Home: poshac.me/docs/latest.
RFC 8555, Automatic Certificate Management Environment (ACME), Abstract.