I succeeded in testing IIS 8.5 against the staging (test) CA using letsencrypt-win-simple as the client. This was simpler than I expected, with documentation being sparse and technobabble-heavy. It really was as simple as making sure I had HTTP bindings defined for each host name the server was supposed to respond to, then running the client application and answering a few prompts. The client read the HTTP bindings and created corresponding HTTPS bindings to match.
IIS Manager then complained that there was no default SSL site created. What it meant was there was no HTTPS binding with a blank host header defined, to help browsers that don’t support server name identification.
Do any IIS users here know if this client supports adding a default HTTPS binding using a new or renewed cert? Or maybe I have to script the creation or replacement of a new binding after creating or renewing a cert. The client does not recognize a default HTTP binding as valid for creating a corresponding default HTTPS binding. Maybe I could do a manual SAN cert for the site instead because I have application request routing and URL rewrite installed, but then I’d still have to create or edit a manual binding for the default HTTPS site.
I’d have asked Lone-Coder, but he isn’t easy to reach. While he has a Google+ page, he has no way of messaging him short of posting to his Google+ wall or whatever it’s called.
This is not a really Letsencrypt related problem but more regarding IIS. In the previous versions of IIS, it was only possible to have one SSL site per server. Now it is possible to have multiple SSL sites but IIS uses the SNI read in the HTTP request to validate the binding. If a user use a VERY old browser, this SNI will not be sent. So IIS won’t be abble to route the request to the correct website. This warning suggests you to create a default SSL website for these kind of requests.