Let's Encrypt on Non Internet Facing Internal Windows Servers

Hi @lbd,

Are those machines publicly visible on the Internet? This is a requirement for some of the methods of obtaining certificates from Let's Encrypt. (Having the machines' names publicly visible on the Internet is a requirement for all the methods; for example, if they're something like printserver.internal as opposed to printserver.caldwell.edu, you can't get a Let's Encrypt certificate for them.)

If you look in the "Windows" section at

you'll find a list of the client applications that can run on Windows. You could potentially run these directly on your servers and obtain certificates that way.

If the servers have publicly-visible IIS web servers running, you could also use a web-based client like https://www.zerossl.com/, which walks you through the steps in your browser (instead of installing any software onto the servers themselves). At the end of the process you might have to convert the certificates you obtain from PEM to PFX format in order to import them on Windows, for which there are a number of recipes available online.

If you have a large number of different web servers you might want to consider the rate limits:

This might prevent you from obtaining a lot of separate certificates, especially if anybody else at your university is also using Let's Encrypt without coordinating with you. However, universities can commonly get an exemption from the rate limits if a responsible party requests it.

1 Like