What this POC tests
Certificates are renewed by software instead of by hand. An ACME client on each server asks the certificate authority for a new certificate before the old one expires, then reloads the web server so it starts using it.
Issue
The ACME client registers with Sectigo, proves control of the domain and receives a certificate.
Deploy
The certificate is installed in the web server, which is reloaded without downtime.
Renew
A scheduled job renews the certificate before expiry, with no one involved.
This test host
- Hostname
poc-acme-win.fpcops.io- Operating system
- Windows Server 2022
- Web server
- IIS
- ACME client
- win-acme
- Certificate authority
- Sectigo Public CA, using ACME with external account binding (OV certificate)
- Domain validation
- DNS TXT record, validated in Sectigo Certificate Manager
- Renewal
- win-acme scheduled task, runs every day and renews when the certificate is due
- Cloud region
- AWS Asia Pacific (Mumbai)
- Companion host
- Ubuntu 24.04 with nginx and certbot, already running the same test
- Owner
- Subhajit Dutta
Certificate on this host
No certificate has been issued on this host yet. This section is filled in after the first Sectigo certificate is installed in IIS.
- Issued by
- Pending
- Issued to
- Pending
- Key type
- Pending
- Valid until
- Pending
Renewal test
A forced renewal will replace the certificate while IIS keeps running. A new serial number will show that a new certificate was issued and deployed without manual steps.
| Before renewal | After renewal | |
|---|---|---|
| Serial number | To be recorded | To be recorded |
| Issuer | To be recorded | To be recorded |
| Deployment | To be recorded | |
Progress
- Linux and Windows servers created and tagged in AWS MumbaiDone
- DNS records created in Route 53Done
- Domain fpcops.io validated and delegated in Sectigo Certificate ManagerDone
- IIS running and reachable from the internet on port 80Done
- Linux host: certificate issued, renewed and deployedDone
- Sectigo ACME account and credentials for this hostIn progress
- First certificate issued and bound to the IIS sitePending
- Forced renewal verified, renewal task activePending
- POC documentation and test results added to the Jira ticketPending
Results against the success criteria
- Both servers can talk to the ACME serverLinux and Windows reach Sectigo and register an ACME account.
- Renewal runs without manual stepsA scheduled job renews the certificate, and a renewal shows a new serial number.
- Renewed certificates are deployed and validatednginx and IIS serve the new certificate, confirmed with a check from outside the server.
- Documentation and findingsThe setup steps, the automation process and the test results are recorded for the team.
What we learned
- Sectigo ACME accounts that use a certificate profile connect to Sectigo’s enterprise ACME endpoint, not to the public version endpoints.
- Domain delegation in the certificate manager must allow subdomains before a host name can be enrolled.
- Domain validation in the certificate manager expires before the renewal window opens, so it needs revalidation or automation in a real deployment.
- Credentials for the ACME account belong in a root-only file, because the client logs its command line.
This is a temporary test system. It holds no production data and will be removed when the POC ends.