How to Fully Remove a Let’s Encrypt Certificate (and Stop It From Renewing) on Windows Server

Let’s Encrypt certificates on Windows Server are almost always issued and renewed by an ACME client rather than manually, most commonly win-acme (wacs.exe), and removing one cleanly means removing it from both the certificate store and the client’s own renewal tracking, not just deleting the certificate itself. Skipping the second part leaves a scheduled task trying to renew a certificate you thought you’d removed.

Step 1: Identify the certificate

Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Issuer -like "*Let's Encrypt*" -or $_.Issuer -like "*R3*" -or $_.Issuer -like "*E1*" } |
    Select-Object Subject, Thumbprint, NotAfter

Let’s Encrypt has rotated its intermediate CA names over time (R3, E1, and others), so matching only on “Let’s Encrypt” in the issuer string can miss some. Cross-check the NotAfter date and subject name against what you actually expect before removing anything, certificate thumbprints are unique but a wrong subject match is an easy mistake to make when a server has several similar-looking certificates.

Step 2: Remove it from the certificate store

Remove-Item -Path "Cert:\LocalMachine\My\"

If the certificate is also bound to an IIS site binding, remove or reassign that binding first, Windows will not let you delete a certificate that’s actively referenced by an active HTTPS binding:

Get-WebBinding | Where-Object { $_.certificateHash -eq "" }
Remove-WebBinding -Name "Default Web Site" -Protocol https -Port 443

Step 3: Remove it from win-acme’s own tracking (the step people forget)

If the certificate was issued by win-acme, it also keeps its own renewal configuration independent of the certificate store. Deleting only the certificate leaves a scheduled task that will fail (or worse, silently reissue a new certificate) on its next renewal attempt:

wacs.exe --list
wacs.exe --cancel --id 

Run wacs.exe --list first to find the exact renewal ID for the certificate you’re removing, since --cancel needs that specific identifier, not the certificate thumbprint.

Step 4: Confirm the scheduled task is gone

Get-ScheduledTask | Where-Object { $_.TaskName -like "*win-acme*" -or $_.TaskName -like "*wacs*" }

win-acme creates a single shared scheduled task that handles renewal for all certificates it manages, not one task per certificate, so this task should still exist if you have other active certificates, and should only be removed entirely if you’re decommissioning win-acme altogether.

Frequently asked questions

I deleted the certificate from the store, but a new one appeared a day later. Why?
This is exactly the “forgot to cancel the renewal in win-acme” scenario. The scheduled task ran, saw a renewal it still believed was active, and issued a fresh certificate. Always run wacs.exe --cancel for the specific renewal before or immediately after removing the certificate manually.

Is it safe to just let a Let’s Encrypt certificate expire naturally instead of removing it manually?
Generally yes for the certificate itself (an expired certificate simply stops being trusted), but the win-acme renewal task will keep attempting to renew it on schedule regardless, generating failure notifications indefinitely unless you explicitly cancel that renewal. Clean removal on both sides avoids ongoing noise in your logs and alerts.