Background

According to the Let's Encrypt website:

"Let’s Encrypt is a free, automated, and open certificate authority brought to you by the non-profit Internet Security Research Group (ISRG)."

According to the Certify The Web documentation:
"Certify The Web (a.k.a Certify) is a Let's Encrypt GUI for Windows, allowing you to request, deploy and auto-renew free SSL/TLS certificates from the letsencrypt.org Certificate Authority"

This document will describe how to install and configure Certify The Web to automate the process of requesting, installing and renewing a server certificate for use on CentreStack.

Procedure

Prerequisites

1. CentreStack must be installed. The Certify configuration will require a working web site in order for the "http-01 challenge" process to succeed.
2. The CentreStack server must have a fully qualified domain (FQDN) that resolves to a publicly accessible IP address. The Let's Encrypt service will call back to the CentreStack server over TCP 80 to verify the web server's identity. This is part of the "http-01 challenge" process.
3. TCP port 80 and TCP port 443 for the CentreStack server's public IP must be port forwarded by the firewall to the private IP address of the CentreStack server.
4. TCP port 80 and TCP port 443 must be allowed in the Windows software firewall (this is the default when IIS is installed on Windows).

Install Certify The Web ("Certify")

1. Navigate to: https://certifytheweb.com
2. Click the download button to download the latest version of Certify:
   
3. Run the installer "as Administrator":
   
4. Accept the license agreement and then click the Next button:
   
5. Leave the default installation path then click the Next button:
   
6. Click the Next button:
   
7. Click the Install button:
   
8. Click the Finish button:
   

Configure Certify the Web

1. Launch Certify The Web,
2. The Certify user interface will be displayed. Click the New Certificate button:
   
3. this message will be displayed, click the OK button:
   
4. Enter your email address then click the Yes, I Agree option and the REGISTER CONTACT button:
   
5.  
6. In the Certificate Domains property sheet:
   1. Change the Select Website drop-down to show the Default Web Site,
   2. Add your fully qualified domain name (FQDN) in the Add domains to certificate text box. In our example screenshots the certificate will be configured for the FQDN "fileshare.acmedrive.com".
   3. Click the ADD DOMAINS button:
7. Once the ADD DOMAINS button was clicked a new row is added to the property sheet to reflect that the subject of the certificate will be the FQDN specified.
   Click the Authorization button to proceed to the next property sheet.
8. The Domain Authorization sheet requires the Website Root Directory. Start IIS Manager and navigate in the left tree pane to the Default Web Site, then click on the Basic Settings option in the right Actions pane:
   
9. Select the text in the Physical Path text box and copy it to the clipboard:
   
10. Return to the Certify The Web app and in the Domain Authorization property sheet:
    1. Set the Challenge Type drop-down to: http-01
    2. Paste the text from the clipboard into the Website Root Directory text box:
       Then click the Deployment button to proceed to the next property sheet.
11. In the Certificate Deployment sheet:
    1. Change the Deployment Mode drop-down to Single Site (selected in Domains tab)
    2. Leave Binding Add/Update as Add or Update https bindings as required
    3. In the Matching any of section enable Binding hostname not specified (IP only or All Unassigned)
    4. Leave Auto create/update IIS bindings (uses SNI):
       
       Click the Test button
12. Assuming the test completes successfully click the right arrow to collapse the Test Progress pane:
    
13. If the test were successful proceed by clicking the Request Certificate button:
    
    If the test was unsuccessful, see the Troubleshooting section at the end of this article.
14. The request process will begin:
    
15. It should complete successfully:
    
16. Click the Settings tab, the defaults are acceptable:
    

Verify the Certificate Installation

1. In IIS Manager, check the bindings for TCP 443. Navigate to the Default Web Site in the left pane and click on Bindings in the Actions pane on the right:
   
2. In the Site Bindings dialog, select the row for https, port 443, then click the Edit button:
   
3. You should see that Certify installed the certificate it obtained and bound it to All Unassigned for TCP port 443:
   
   Click on the View button.
4. The certificate information will be displayed. Notice that Let's Encrypt certificate expire in 90 days. This is OK since Certify will renew the certificate every 14 days by default.
   
   Click on the Certification Path tab
5. This shows the Certification Path:
6. Use a browser on a client PC to verify the certificate is valid for your website:
   

Troubleshooting

If the http-01 challenge fails it could be caused by this issue: https://github.com/ebekker/ACMESharp/issues/15

Attempt to navigate to this URL from a browser outside the CentreStack server's network: http://<fqdn>/.well-known/acme-challenge/configcheck

If you receive a 404 error save this text as "C:\Program Files (x86)\Gladinet Cloud Enterprise\root\.well-known\acme-challenge\web.config" as described here: https://github.com/ebekker/ACMESharp/issues/15#issuecomment-231272435