I am trying to generate SSL SAN certificate with IIS8.5. I am using letsencrypt-win-simple.V1.9.1 Script. The IIS has Default Website and bind to hostname: test.xyz.edu.pk.
In DNS all three SAN entries are pointed to same IIS server.
Enter all Alternative Names seperated by a comma: test.xyz.edu.pk,test2.xyz.edu.pk,test3.xyz.edu.pk
5.Enter a site path (the web root of the host for http authentication): %SystemDrive%\inetpub\wwwroot
To expand on @ahaw021's point, these are internal private IP addresses which are not reachable from the Internet, and perhaps only on an internal organizational DNS server, not in the public view of the DNS. That means (for both reasons) Let's Encrypt can't confirm your ownership of this domain by connecting to your servers.
I am able to generate certificate by binding all three names in IIS with this IP. The domains were validated but 3 separate .pfx files are generated. I dont know its right procedure or not.
I am using the below procedure to generate the SAN certificate. The domains were validated but 3 separate .pfx files are generated. Why it is not creating single .pfx file ? Why 3 ? Is it considering each .pfx file as a separate certificate ?
PS C:\letsencrypt-win-simple.V1.9.1> .\letsencrypt.exe --san --centralsslstore C:\Central_SSL\
Let's Encrypt (Simple Windows ACME Client)
Renewal Period: 60
Certificate Store: WebHosting
ACME Server: https://acme-v01.api.letsencrypt.org/
Using Centralized SSL Path: C:\Central_SSL\
Config Folder: C:\Users\Administrator\AppData\Roaming\letsencrypt-win-simple\httpsacme-v01.api.letsencrypt.org
Certificate Folder: C:\Users\Administrator\AppData\Roaming\letsencrypt-win-simple\httpsacme-v01.api.letsencrypt.org
Loading Signer from C:\Users\Administrator\AppData\Roaming\letsencrypt-win-simple\httpsacme-v01.api.letsencrypt.org\Sign
er
Getting AcmeServerDirectory
Loading Registration from C:\Users\Administrator\AppData\Roaming\letsencrypt-win-simple\httpsacme-v01.api.letsencrypt.or
g\Registration
Scanning IIS Sites
1: SAN - IIS Default Web Site (C:\inetpub\wwwroot)
W: Generate a certificate via WebDav and install it manually.
S: Generate a single San certificate for multiple sites.
F: Generate a certificate via FTP/ FTPS and install it manually.
M: Generate a certificate manually.
A: Get certificates for all hosts
Q: Quit
Which host do you want to get a certificate for: M
Enter a host name: test.pma.edu.pk
Enter all Alternative Names seperated by a comma test.pma.edu.pk,test2.pma.edu.pk,test3.pma.edu.pk
Enter a site path (the web root of the host for http authentication): %SystemDrive%\inetpub\wwwroot
Authorizing Identifier test.pma.edu.pk Using Challenge Type http-01
Writing challenge answer to C:\inetpub\wwwroot\.well-known/acme-challenge/dooo02yy-U2OuGB-1Zs6G6gnw2RWq_8ClB3oJxPYZLE
Answer should now be browsable at http://test.pma.edu.pk/.well-known/acme-challenge/dooo02yy-U2OuGB-1Zs6G6gnw2RWq_8ClB3
oJxPYZLE
Submitting answer
Authorization Result: valid
Authorizing Identifier test2.pma.edu.pk Using Challenge Type http-01
Writing challenge answer to C:\inetpub\wwwroot\.well-known/acme-challenge/fWgqjX4Rr6Yi7jbyx0kjB4Una3hKsyDTWlWnvFO5V5A
Answer should now be browsable at http://test2.pma.edu.pk/.well-known/acme-challenge/fWgqjX4Rr6Yi7jbyx0kjB4Una3hKsyDTWl
WnvFO5V5A
Submitting answer
Authorization Result: valid
Authorizing Identifier test3.pma.edu.pk Using Challenge Type http-01
Writing challenge answer to C:\inetpub\wwwroot\.well-known/acme-challenge/oj6q3_pNJHqV9GCAbYysHZ3ELgGKOtVi3JW_zd0smrg
Answer should now be browsable at http://test3.pma.edu.pk/.well-known/acme-challenge/oj6q3_pNJHqV9GCAbYysHZ3ELgGKOtVi3J
W_zd0smrg
Submitting answer
Authorization Result: valid
Requesting Certificate
Request Status: Created
Saving Certificate to C:\Users\Administrator\AppData\Roaming\letsencrypt-win-simple\httpsacme-v01.api.letsencrypt.org\t
est.pma.edu.pk-crt.der
Saving Issuer Certificate to C:\Users\Administrator\AppData\Roaming\letsencrypt-win-simple\httpsacme-v01.api.letsencryp
t.org\ca-0A0141420000015385736A0B85ECA708-crt.pem
Host: test.pma.edu.pk
Saving Certificate to C:\Central_SSL\test.pma.edu.pk.pfx
Host: test2.pma.edu.pk
Saving Certificate to C:\Central_SSL\test2.pma.edu.pk.pfx
Host: test3.pma.edu.pk
Saving Certificate to C:\Central_SSL\test3.pma.edu.pk.pfx
WARNING: Unable to configure server software.
Do you want to replace the existing letsencrypt-win-simple httpsacme-v01.api.letsencrypt.org task? (Y/N)
