What is Posh-ACME?

Posh-ACME is a free tool that automatically creates and renews SSL/TLS certificates for your websites and servers. Think of an SSL certificate as the digital padlock that appears in your browser when you visit a secure (https://) website — Posh-ACME handles getting that padlock for you, completely automatically.

Without a tool like Posh-ACME, you would need to manually request a certificate from a certificate authority, install it on your web server, and remember to renew it every 90 days before it expires. Posh-ACME does all of this work for you.

What This Guide Covers

This guide will walk you through every step of the following:

• Issuing (creating) SSL certificates for your domain names
• Finding where your certificates are saved on your computer
• Setting up automatic renewal so certificates never expire
• Installing certificates on your web server (IIS, Apache, Nginx, or Plesk)
• Monitoring your certificates to ensure they stay valid
• Fixing common problems you might run into

Section 1 — Getting Started

Before you issue any certificates, you need to load your Posh-ACME settings in your PowerShell window. You will need to do this every time you open a fresh PowerShell session to work with Posh-ACME.

Step 1 — Load Your Configuration

Open PowerShell and run the following command. This loads all the settings you created during installation (such as your DNS provider credentials and ACME server details).

. "$HOME\.poshacme-config.ps1"

Step 2 — Verify Your Setup Is Working

After loading the configuration, check that Posh-ACME can see your ACME server and account. Run these two commands:

Get-PAServer | Select-Object location, status

Get-PAAccount | Select-Object id, status, contact

You should see output confirming your server address and account status. The status field should show 'valid' for a healthy setup.

Section 2 — Issuing SSL Certificates

Posh-ACME supports three types of certificates. Choose the one that matches your situation:

How Certificate Issuance Works

When you request a certificate, Posh-ACME proves to the certificate authority (Let's Encrypt or ZeroSSL) that you actually own the domain name. It does this using a method called DNS-01 validation:

1. Posh-ACME creates a temporary hidden text record in your domain's DNS settings.
2. The certificate authority checks for this record to confirm you control the domain.
3. Once confirmed, the certificate is issued and saved to your computer.
4. Posh-ACME removes the temporary DNS record automatically.

Option A — Single Domain Certificate

Use this when you need a certificate for just one specific domain name.

New-PACertificate "demo.example.com" `
  -Plugin Cloudflare `
  -PluginArgs $pArgs `
  -Verbose

What you will see while it runs:

[demo.example.com] Generating new order
[demo.example.com] Creating DNS TXT record for _acme-challenge.demo.example.com
[demo.example.com] Waiting for DNS propagation (30 seconds)
[demo.example.com] DNS propagation complete
[demo.example.com] Validating challenge
[demo.example.com] Finalizing order
[demo.example.com] Certificate issued successfully
[demo.example.com] Saved to: C:\Users\...\Posh-ACME\...\demo.example.com\

The process usually takes between 1 and 3 minutes. The most time is spent waiting for the DNS record to become visible across the internet (this is called 'DNS propagation').

Option B — Multi-Domain (SAN) Certificate

Use this when you want a single certificate to cover several specific domain names. List all the domains you want separated by commas.

New-PACertificate "example.com", "www.example.com", "mail.example.com" `
  -Plugin Cloudflare `
  -PluginArgs $pArgs `
  -Verbose

Option C — Wildcard Certificate

Use this when you want to secure all possible sub-domains under a domain. A wildcard certificate for *.example.com will automatically cover shop.example.com, blog.example.com, app.example.com, and any other sub-domain you create.

Important: Wildcard certificates do NOT cover the root domain (example.com) by default. That is why we include it separately in the command below.

New-PACertificate "*.example.com", "example.com" `
  -Plugin Cloudflare `
  -PluginArgs $pArgs `
  -Verbose

Section 3 — Where Are Your Certificates Saved?

After a certificate is successfully issued, Posh-ACME saves several files to your computer. Each file serves a specific purpose.

Certificate File Location

On Windows:

C:\Users\{username}\AppData\Local\Posh-ACME\{server-hash}\{account-hash}\{domain}\

??? cert.cer        # End-entity certificate (PEM)
??? cert.pfx        # Certificate + key (PKCS#12, default password: 'poshacme')
??? chain.cer       # Intermediate certificate(s)
??? chainX.cer      # Alternative chain (if available)
??? fullchain.cer   # Certificate + intermediates (use for web servers)
??? fullchain.pfx   # Full chain + key (PKCS#12)
??? cert.key        # Private key (PEM, unencrypted)

On Linux and macOS:

~/.local/share/Posh-ACME/{server-hash}/{account-hash}/{your-domain}/

What Each Certificate File Does

How to Find Your Certificate File Paths

If you need to know the exact file paths for your certificates (for example, when writing a deployment script), run this command:

$order = Get-PAOrder -MainDomain "demo.example.com"

Write-Host "Certificate (PEM): $($order.CertFile)"
Write-Host "Private Key (PEM): $($order.KeyFile)"
Write-Host "Full Chain (PEM):  $($order.ChainFile)"
Write-Host "PFX (PKCS#12):     $($order.PfxFile)"
Write-Host "PFX Password:      poshacme"

Section 4 — Setting Up Automatic Renewal

SSL certificates expire after 90 days. Posh-ACME can automatically renew them before they expire — but only if you set up a scheduled task (Windows) or cron job (Linux/macOS) to run the renewal script regularly.

Posh-ACME is smart enough to know when a certificate needs renewing. It will only actually renew a certificate when it is within 30 days of expiry, so it is safe to run the renewal script every day without worrying about unnecessary renewals.

Option A — Windows: Scheduled Task

Follow these steps to set up automatic renewal on Windows. The scheduled task will run every day at 2:00 AM and renew any certificates that are close to expiring.

Step 1 — Create the Renewal Script

This command creates a PowerShell script file at C:\Scripts\renew-certificates.ps1 that will do the actual renewal work when it runs.

# Set the path where the script will be saved
$renewScript = "C:\Scripts\renew-certificates.ps1"

# Create the script file
@"
Import-Module Posh-ACME

# Load your configuration
. "$HOME\.poshacme-config.ps1"

# Set up logging so you can see what happened
$logFile = "C:\Scripts\Logs\poshacme-renew-$(Get-Date -Format 'yyyy-MM-dd').log"

function Write-Log {
    param([string]$message)
    $timestamp = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
    "$timestamp - $message" | Out-File -FilePath $logFile -Append
    Write-Host "$timestamp - $message"
}

Write-Log "Starting certificate renewal check"

# Renew certificates (only renews if within 30 days of expiry)
Submit-Renewal -Verbose 2>&1 | Out-File -FilePath $logFile -Append

Write-Log "Certificate renewal check completed"
"@ | Out-File -FilePath $renewScript -Encoding UTF8

Write-Host "Renewal script created: $renewScript"

Step 2 — Create the Log Folder

Before the scheduled task can run, the folder where it will save log files needs to exist. Run this command to create it:

New-Item -Path "C:\Scripts\Logs" -ItemType Directory -Force

Step 3 — Create the Scheduled Task

Now create the scheduled task that will run the renewal script automatically every day at 2:00 AM.

# Define the task name and what it does
$taskName = "Posh-ACME Certificate Renewal"
$taskDescription = "Automatically renew SSL certificates using Posh-ACME"

# Tell Windows what program to run and with what arguments
$taskAction = New-ScheduledTaskAction `
    -Execute "pwsh.exe" `
    -Argument "-NoProfile -ExecutionPolicy Bypass -File `"C:\Scripts\renew-certificates.ps1`""

# Run every day at 2:00 AM
$taskTrigger = New-ScheduledTaskTrigger -Daily -At 2:00AM

# Run as the SYSTEM account (no user needs to be logged in)
$taskPrincipal = New-ScheduledTaskPrincipal `
    -UserId "SYSTEM" `
    -LogonType ServiceAccount `
    -RunLevel Highest

# Register (create) the scheduled task
Register-ScheduledTask `
    -TaskName $taskName `
    -Action $taskAction `
    -Trigger $taskTrigger `
    -Principal $taskPrincipal `
    -Description $taskDescription `
    -Force

Write-Host "Scheduled task created: $taskName"

Step 4 — Verify the Scheduled Task Was Created

Get-ScheduledTask -TaskName "Posh-ACME Certificate Renewal"

Step 5 — Test the Scheduled Task

Run the task manually right now to confirm it works correctly before waiting for the scheduled time:

Start-ScheduledTask -TaskName "Posh-ACME Certificate Renewal"

After running it, check the log file at C:\Scripts\Logs\ to see if the renewal check completed successfully.

Option B — Linux / macOS: Cron Job

On Linux and macOS, use a cron job to run the renewal script automatically. Follow these steps:

Step 1 — Create the Renewal Script

sudo tee /usr/local/bin/poshacme-renew.sh > /dev/null << 'EOF'
#!/bin/bash
# Posh-ACME Renewal Script

LOG_FILE="/var/log/poshacme-renew-$(date '+%Y-%m-%d').log"

log() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

log "Starting certificate renewal check"

# Run the Posh-ACME renewal inside PowerShell
pwsh -NoProfile -Command "
    Import-Module Posh-ACME
    . \"\$HOME/.poshacme-config.ps1\"
    Submit-Renewal -Verbose
" >> "$LOG_FILE" 2>&1

log "Certificate renewal check completed"
EOF

# Make the script executable
sudo chmod +x /usr/local/bin/poshacme-renew.sh

Step 2 — Add the Cron Job

# Open the crontab editor
sudo crontab -e

# Add this line at the bottom of the file (runs daily at 2:00 AM):
0 2 * * * /usr/local/bin/poshacme-renew.sh >> /var/log/poshacme-cron.log 2>&1

Step 3 — Test the Script

sudo /usr/local/bin/poshacme-renew.sh

Then check the log file to see the output: /var/log/poshacme-renew-{today's-date}.log

Section 5 — Installing Certificates on Your Web Server

Once your certificate is issued, you need to install it on your web server so that visitors to your website will see the secure padlock in their browser. This section covers all major web server types.

Option A — IIS (Windows Web Server)

IIS (Internet Information Services) is Microsoft's web server that comes built into Windows Server. It uses the PFX file format for certificates.

Manual Installation Steps

# Step 1: Find your certificate PFX file
$order = Get-PAOrder -MainDomain "demo.example.com"
$pfxPath = $order.PfxFile
$pfxPassword = "poshacme"

# Step 2: Import the certificate into the Windows certificate store
$certPassword = ConvertTo-SecureString -String $pfxPassword -AsPlainText -Force
$cert = Import-PfxCertificate `
    -FilePath $pfxPath `
    -CertStoreLocation Cert:\LocalMachine\My `
    -Password $certPassword

Write-Host "Certificate imported"
Write-Host "Thumbprint: $($cert.Thumbprint)"

# Step 3: Bind the certificate to your IIS website
Import-Module WebAdministration

$siteName = "Default Web Site"

# Create HTTPS binding if one does not already exist
$binding = Get-WebBinding -Name $siteName -Protocol https
if ($binding -eq $null) {
    New-WebBinding -Name $siteName -Protocol https -Port 443
}

# Attach the new certificate to the HTTPS binding
$binding = Get-WebBinding -Name $siteName -Protocol https
$binding.AddSslCertificate($cert.Thumbprint, "My")

Write-Host "Certificate bound to IIS site: $siteName"

Automated IIS Deployment Script

Save the following script as C:\Scripts\deploy-iis-cert.ps1. You can then run it any time you need to deploy or update the certificate on your IIS site.

# Usage: .\deploy-iis-cert.ps1 -Domain "demo.example.com" -SiteName "Default Web Site"

param(
    [Parameter(Mandatory=$true)]
    [string]$Domain,

    [Parameter(Mandatory=$true)]
    [string]$SiteName
)

Import-Module WebAdministration

$order = Get-PAOrder -MainDomain $Domain
$pfxPath = $order.PfxFile
$pfxPassword = "poshacme"

$certPassword = ConvertTo-SecureString -String $pfxPassword -AsPlainText -Force
$cert = Import-PfxCertificate -FilePath $pfxPath `
    -CertStoreLocation Cert:\LocalMachine\My -Password $certPassword

$binding = Get-WebBinding -Name $SiteName -Protocol https

if ($binding) {
    $binding.AddSslCertificate($cert.Thumbprint, "My")
    Write-Host "Certificate deployed to $SiteName"
} else {
    Write-Host "No HTTPS binding found for $SiteName"
}

To run the script:

.\deploy-iis-cert.ps1 -Domain "demo.example.com" -SiteName "Default Web Site"

Option B — Apache (Linux or Windows)

Automated Apache Deployment Script

# Usage: .\deploy-apache-cert.ps1 -Domain "demo.example.com"

param(
    [Parameter(Mandatory=$true)]
    [string]$Domain,

    [string]$ApacheCertPath = "/etc/ssl/certs",
    [string]$ApacheKeyPath  = "/etc/ssl/private"
)

# Get the certificate and key file paths from Posh-ACME
$order    = Get-PAOrder -MainDomain $Domain
$certFile = $order.ChainFile  # Always use the full chain file for Apache
$keyFile  = $order.KeyFile

if ($IsLinux -or $IsMacOS) {
    sudo cp $certFile "$ApacheCertPath/$Domain.crt"
    sudo cp $keyFile  "$ApacheKeyPath/$Domain.key"

    sudo chmod 644 "$ApacheCertPath/$Domain.crt"
    sudo chmod 600 "$ApacheKeyPath/$Domain.key"

    sudo systemctl reload apache2   # Debian/Ubuntu
    # OR: sudo systemctl reload httpd   # CentOS/RHEL

    Write-Host "Certificate deployed to Apache"
} else {
    Copy-Item $certFile "C:\Apache24\conf\ssl\$Domain.crt" -Force
    Copy-Item $keyFile  "C:\Apache24\conf\ssl\$Domain.key" -Force
    Restart-Service -Name "Apache2.4"
    Write-Host "Certificate deployed to Apache (Windows)"
}

Apache VirtualHost Configuration Example

<VirtualHost *:443>
    ServerName   demo.example.com
    DocumentRoot /var/www/demo.example.com

    SSLEngine on
    SSLCertificateFile    /etc/ssl/certs/demo.example.com.crt
    SSLCertificateKeyFile /etc/ssl/private/demo.example.com.key

    SSLProtocol    -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
</VirtualHost>

Option C — Nginx (Linux or Windows)

Automated Nginx Deployment Script

# Usage: .\deploy-nginx-cert.ps1 -Domain "demo.example.com"

param(
    [Parameter(Mandatory=$true)]
    [string]$Domain,

    [string]$NginxCertPath = "/etc/nginx/ssl"
)

$order    = Get-PAOrder -MainDomain $Domain
$certFile = $order.ChainFile
$keyFile  = $order.KeyFile

if ($IsLinux -or $IsMacOS) {
    sudo mkdir -p $NginxCertPath

    sudo cp $certFile "$NginxCertPath/$Domain.crt"
    sudo cp $keyFile  "$NginxCertPath/$Domain.key"

    sudo chmod 644 "$NginxCertPath/$Domain.crt"
    sudo chmod 600 "$NginxCertPath/$Domain.key"

    sudo nginx -t
    sudo systemctl reload nginx

    Write-Host "Certificate deployed to Nginx"
} else {
    New-Item -Path "C:\nginx\ssl" -ItemType Directory -Force
    Copy-Item $certFile "C:\nginx\ssl\$Domain.crt" -Force
    Copy-Item $keyFile  "C:\nginx\ssl\$Domain.key" -Force
    nginx.exe -s reload
    Write-Host "Certificate deployed to Nginx (Windows)"
}

Nginx Server Block Configuration Example

server {
    listen 443 ssl http2;
    server_name demo.example.com;
    root /var/www/demo.example.com;

    ssl_certificate     /etc/nginx/ssl/demo.example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/demo.example.com.key;

    ssl_protocols             TLSv1.2 TLSv1.3;
    ssl_ciphers               ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
}

Option D — Plesk (Windows)

Automated Plesk Deployment Script

# Usage: .\deploy-plesk-cert.ps1 -Domain "demo.example.com"

param(
    [Parameter(Mandatory=$true)]
    [string]$Domain
)

$order     = Get-PAOrder -MainDomain $Domain
$certFile  = $order.CertFile
$keyFile   = $order.KeyFile
$chainFile = $order.ChainFile

$certPath  = $certFile  -replace '\\', '/'
$keyPath   = $keyFile   -replace '\\', '/'
$chainPath = $chainFile -replace '\\', '/'

# Step 1: Create the certificate in Plesk
& "C:\Program Files (x86)\Plesk\bin\certificate.exe" --create "$Domain-cert" `
    -cert-file   $certPath `
    -key-file    $keyPath `
    -cacert-file $chainPath

# Step 2: Assign the certificate to your Plesk domain
& "C:\Program Files (x86)\Plesk\bin\site.exe" --update $Domain `
    -certificate-name "$Domain-cert"

Write-Host "Certificate deployed to Plesk domain: $Domain"

To run the script:

.\deploy-plesk-cert.ps1 -Domain "demo.example.com"

Section 6 — Advanced: Auto-Deploy After Renewal

By default, the renewal script only renews the certificate files — it does not automatically push them to your web server. You can add 'post-renewal hooks' to your renewal script so that every time a certificate is renewed, it is also automatically deployed to your web server.

Save this as C:\Scripts\renew-and-deploy.ps1:

Import-Module Posh-ACME
Import-Module WebAdministration

# Load configuration
. "$HOME\.poshacme-config.ps1"

# Step 1: Renew any certificates that are due
Submit-Renewal -Verbose

# Step 2: Deploy all valid (renewed) certificates to IIS
$orders = Get-PAOrder -List | Where-Object { $_.status -eq 'valid' }

foreach ($order in $orders) {
    $domain      = $order.MainDomain
    $pfxPath     = $order.PfxFile
    $pfxPassword = "poshacme"

    $certPassword = ConvertTo-SecureString -String $pfxPassword -AsPlainText -Force
    $cert = Import-PfxCertificate -FilePath $pfxPath `
        -CertStoreLocation Cert:\LocalMachine\My -Password $certPassword

    $site = Get-WebSite | Where-Object { $_.Name -like "*$domain*" }
    if ($site) {
        $binding = Get-WebBinding -Name $site.Name -Protocol https
        if ($binding) {
            $binding.AddSslCertificate($cert.Thumbprint, "My")
            Write-Host "Certificate deployed to $($site.Name)"
        }
    }
}

Update your scheduled task (or cron job) to run renew-and-deploy.ps1 instead of renew-certificates.ps1 so the deployment happens automatically every time a renewal occurs.

Section 7 — Monitoring Your Certificates

Even with automatic renewal set up, it is good practice to regularly check your certificates to make sure everything is working correctly.

Check When Your Certificates Expire

Get-PAOrder -List | Select-Object MainDomain, status, CertExpires | Format-Table

To check a specific domain and see how many days are left:

$order = Get-PAOrder -MainDomain "demo.example.com"

Write-Host "Domain:         $($order.MainDomain)"
Write-Host "Status:         $($order.status)"
Write-Host "Expires:        $($order.CertExpires)"
Write-Host "Days remaining: $(($order.CertExpires - (Get-Date)).Days)"

View Renewal Logs

On Windows:

# View today's log (last 50 lines)
Get-Content "C:\Scripts\Logs\poshacme-renew-$(Get-Date -Format 'yyyy-MM-dd').log" -Tail 50

# List all available log files
Get-ChildItem "C:\Scripts\Logs\poshacme-renew-*.log" | Sort-Object LastWriteTime -Descending

On Linux / macOS:

# Stream today's log in real time
tail -f /var/log/poshacme-renew-$(date '+%Y-%m-%d').log

# List all available log files
ls -lht /var/log/poshacme-renew-*.log

Force a Manual Renewal (for Testing)

# Force renewal of all certificates
Submit-Renewal -Force -Verbose

# Force renewal of one specific domain
Set-PAOrder -MainDomain "demo.example.com"
Submit-Renewal -Force -Verbose

Section 8 — Troubleshooting Common Issues

Problem 1 — DNS Propagation Timeout

What you see: The certificate request hangs or fails at the 'Waiting for DNS propagation' step.

Why it happens: After Posh-ACME adds the DNS verification record to your domain, it needs to wait for that record to become visible across the internet. By default it waits 120 seconds, but some DNS providers take longer.

How to fix it: Tell Posh-ACME to wait longer by adding -DnsSleep 180 (180 seconds) to your command:

New-PACertificate "demo.example.com" `
  -Plugin Cloudflare `
  -PluginArgs $pArgs `
  -DnsSleep 180 `
  -Verbose

Problem 2 — 'Order Finalization Timed Out' Error

What you see: An error message saying 'Order finalization timed out'.

Why it happens: The ACME server is taking longer than Posh-ACME's default timeout to confirm the certificate is ready.

How to fix it: This requires modifying the Submit-OrderFinalize.ps1 file to increase the timeout. Please refer to the Installation Guide for instructions on how to make this change.

Problem 3 — PFX Password Not Working

What you see: You are asked for a password when importing the PFX file and your password is being rejected.

Why it happens: The default PFX password set by Posh-ACME is 'poshacme'. If you are getting an incorrect password error, double-check that you are using this exact password.

How to fix it or change the password for future certificates:

New-PACertificate "demo.example.com" `
  -Plugin Cloudflare `
  -PluginArgs $pArgs `
  -PfxPass "YourNewCustomPassword" `
  -Verbose

Problem 4 — Cannot Find the Certificate Files

What you see: You are not sure where the certificate files were saved, or you cannot find the folder.

How to fix it: Run the following command — it will show you the exact full path to each certificate file:

$order = Get-PAOrder -MainDomain "demo.example.com"
$order | Select-Object CertFile, KeyFile, PfxFile, ChainFile | Format-List

Section 9 — Production Readiness Checklist

Before considering your Posh-ACME deployment complete, work through each item on this checklist.

Installation & Configuration

Certificate Issuance

Deployment

Automation

Monitoring & Maintenance

Section 10 — Support and Useful Resources

Getting the Best Help

When asking for help, always include the following information to get a faster and more accurate response:

• Your operating system (Windows Server 2022, Ubuntu 22.04, etc.)
• Your PowerShell version (run

  Sections

  • CSR Generation
  • Troubleshooting
  • SSL Installation
  • Validation
  • Installation
  • Deployment