Introduction
I first installed SSL certificates on my sites using Certbot version 1.31.0 which was released on October 4, 2022. In November 2023, the certifcating authority, Let's Encrypt, announced that Windows support for Certbot would no longer be available after February 2024. The last version of Certbot that worked on Windows was version 2.9.0 which was released on February 8, 2024.
This last version of Certbot for Windows renewed the certficates in December 2025, but in January 2026, it refused to run properly. This meant I had to look for a new ACME (Automatic Certificate Management Environment) client to get new certficates and then renew them. Looking through the list of ACME clients, I chose to look at simple-acme.
System Setup
My installation of Apache is slightly unusual as I use a version compiled for Windows from Apache Lounge that has the mod_ssl module already configured. I also run multiple virtual hosts on the server that all need certificates.
- I use Apache web server on Windows 11
- Apache uses the PEM (Privacy-Enhanced Mail) certificate format
- I use Let's Encrypt as the Certificate Authority
- I currently use ECC encryption for the public keys
- I have access to the Apache configuration files in case the location of the certificates needs changing
- I have access to the DNS configuration through DNSExit in case the authentication keys needs updating
- DNSExit provides an account API key so that I can use a DNS-01 challenge for the domains I have registered with them. This requires the DNSExit DNS validation plugin to be downloaded and put in a folder named plugins wherever simple-acme was placed.
- An advantage of using the DNS-01 challenge is that the Apache server does not need to be stopped while the authentication takes place and certificates downloaded.
simple-acme
simple-acme is a command line interface (CLI) program. It just needs downloading, unzipped and placed whereever on the system you want it.
It has a lot of documentation that should be read through. It has a lot command line options and various plugins are available including one for DNSExit so the verifications records can be written.
Usage
Once inzipped, open a command prompt with administrator permissions. Change directory to where simple-acme was unzipped to and type wacs to start the program. Follow the on-screen prompts to get the certificates.
There are three ways to use simple-acme, follow the prompts on the command line, put all the variables the program uses on the command line or use an external JSON (JavaScript Object Notation) file to hold the variables.
simple-acme has several defaults referring to Microsoft Windows IIS (Internet Information Services) servers, I use Apache for Windows from Apache Lounge and just downloaded the PEM (Privacy Enhanced Mail) files that Apache uses with no problems.
Command Line Prompts
Running simple-acme CLI as a series of prompts
simple-acme asking for the site names and which type of certificate to get
simple-acme asking for the verification for the site names
simple-acme asking where to save the SSL key files and their encryption type
simple-acme asking which SSL certificate file type to get and where to put it
simple-acme asking if an alternative SSL certificate store can be used
simple-acme asking which Let's Encrypt server to use and getting the files
If necessary change the location of the certificates in Apache's configuration files, in my case these are httpd-ssl.conf and httpd-vhosts.conf.
simple-acme will produce a Task Scheduler entry to renew the certificates automatically.
I also used the Qualsys SSL Server Test to ensure all the certificates were installed correctly. They all came back with a rating of A+
Qualsys SSL Server Test result
Problems
When I renewed the certificates in September 2026, I ran into a few problems. DNSExit's propagation of the text records to its nameservers took a bit longer than usual.
This means that simple-acme had to retry contacting the nameservers multiple times for the renewal. This is automatic with 10 retries allowed.
A bigger problem was that the connection between simple-acme and Let's Encrypt was dropped multiple times during the renewal which meant the program had to be restarted before the certificate download could begin.