Overview

There are three main use cases, interactive, unattended and scheduled.

Interactive

Interactive mode can be launched by just starting the .exe and following the instructions on the screen. There are some Command Line Arguments which might be helpful for your purposes, such as --hidehttps.

Unattended

The other main way is to use unattended mode, which is triggered by the --target switch. Target refers to the target generator plugin, of which the most common ones are as follows.

• --target manual - input host names manually, optionally launch script to install it
• --target iissite - create certificate for a specific IIS site and create/update bindings

Each plugin has their own inputs which it needs to generate the certificate, for example:

wacs.exe --target manual --host www.domain.com --webroot C:\sites\wwwroot

wacs.exe --target iissite --siteid 1 --excludebindings exclude.me

There are some other parameters needed for first-time unattended use (e.g. on a clean server) to create the Let's Encrypt registration automatically (--emailaddress myaddress@example.com --accepttos).

One more parameters is needed for a first run to either prevent the creation of a scheduled task (--notaskscheduler), or to accept that it will be created under the default SYSTEM credential (--usedefaulttaskuser). So a full command line to create a certificate for IIS site 1 on a clean server (except for the 'exclude.me' binding) would look like this:

wacs.exe --target iissite --siteid 1 --excludebindings exclude.me --emailaddress myaddress@example.com --accepttos --usedefaulttaskuser

Renew

While renewal is possible from interactive mode, most users would run it as a scheduled task, which the program offers to create for you in interactive mode. The --renew parameter renews all certificates which are due (55 days after the last successfully issued certificate by default), whereas --renew --force simply attempts to renew every certificate which has been created so far.