Windows Server2025 : ＷＥＢサイト、FTP SSL化

Contents

Let's Encrypt証明書取得及びＷＥＢサイト SSL化
FTP SSL化

Let's Encrypt証明書取得及びＷＥＢサイト SSL化

1.事前準備
・Let's Encrypt から SSL 証明書を定期的に取得する win-acme をダウンロード
・[win-acme.v2.2.9.1701.x64.trimmed.zip]をダウンロード
・[win-acme.v2.2.9.1701.x64.trimmed.zip]の中身をWindows Server の任意のフォルダへ展開

http-01でドメイン名の所有確認する時に、\inetpub/win.korodes.com/.well-known/acme-challenge/に下記内容のファイルを設置しておく必要があります。(\inetpub/win.korodes.com/.well-known/acme-challenge/フォルダがない場合は事前作成しておく)

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
     <system.webServer>
         <staticContent>
             <mimeMap fileExtension="." mimeType="text/xml" />
         </staticContent>
     </system.webServer>
</configuration>

<?xml version="1.0" encoding="UTF-8"?>

<system.webServer>

</staticContent>

</system.webServer>

</configuration>

2.証明書取得
・win-acme の実行(展開したファイルの「wacs.exe」を「管理者権限」で起動)

A simple Windows ACMEv2 client (WACS)
Software version 2.2.9.1701 (release, trimmed, standalone, 32-bit)
Connecting to https://acme-v02.api.letsencrypt.org/…
Connection OK!
Scheduled task not configured yet
Please report issues at https://github.com/win-acme/win-acme

N: Create certificate (default settings)
M: Create certificate (full options)
R: Run renewals (0 currently due)
A: Manage renewals (0 total)
O: More options…
Q: Quit

Please choose from the menu: N ←新しく作成するので「N」を入力

Running in mode: Interactive, Simple

Please select which website(s) should be scanned for host names. You may
input one or more site identifiers (comma-separated) to filter by those
sites, or alternatively leave the input empty to scan all websites.

2: WIN-KORODES (1 binding)

Site identifier(s) or to choose all: 2 ←対象のサイトの番号を入力

1: win.korodes.com (Site 2)

Listed above are the bindings found on the selected site(s). By default all
of them will be included, but you may either pick specific ones by typing the
host names or identifiers (comma-separated) or filter them using one of the
options from the menu.

P: Pick bindings based on a search pattern
A: Pick all bindings

Binding identifiers(s) or menu option: A ←通常はA

1: win.korodes.com (Site 2)

Continue with this selection? (y*/n) - yes ←yesで確定する

Source generated using plugin IIS: win.korodes.com

Open in default application? (y/n*) - yes ←yesで確定する

Do you agree with the terms? (y*/n) - yes ←yesで確定する

Enter email(s) for notifications about problems and abuse (comma-separated):
hoge@hoge.com ←自メールアドレス

Plugin IIS generated source win.korodes.com with 1 identifiers
Plugin Single created 1 order
[win.korodes.com] Authorizing…
[win.korodes.com] Authorizing using http-01 validation (SelfHosting)
[win.korodes.com] Authorization result: valid
Downloading certificate [IIS] WIN-KORODES, (any host)
Store with CertificateStore…
Installing certificate in the certificate store
Adding certificate [IIS] WIN-KORODES, (any host) @ 2025/3/27 in store WebHosting
Adding certificate CN=R11, O=Let's Encrypt, C=US in store CA
Installing with IIS…
Adding new https binding *:443:win.korodes.com
Committing 1 https binding changes to IIS while updating site 2
Adding Task Scheduler entry with the following settings

Name win-acme renew (acme-v02.api.letsencrypt.org)
Path C:\Users\Administrator\Downloads\win-acme.v2.2.9.1701.x86.trimmed
Command wacs.exe --renew --baseuri "https://acme-v02.api.letsencrypt.org/"
Start at 09:00:00
Random delay 04:00:00
Time limit 02:00:00
Adding renewal for [IIS] WIN-KORODES, (any host)
Next renewal due after 2025/5/21
Certificate [IIS] WIN-KORODES, (any host) created

上記で完了

3.証明書の確認
[サーバーマネージャー][ツール][IISマネージャー]「サーバー証明書」をダブルクリック