U.S. Homeland Security employees locked out of computer networks

There are very good ACME clients (ACMESharp, etc) for windows that allow doing http-01 and dns-01 certificate issuance. Additionally, there is IIS integration (letsencrypt-win-simple) with the stuff you would expect (cert generation for all or specific sites, automatic renewal, etc).

Basically the only thing Windows doesn't have is official support in the Certbot client.

2. Let's Encrypt certificates are indeed the lowest grade of SSL certificate. That's not a criticism of Let's Encrypt, it's just the nature of the situation. There are legitimate reasons to consider it too low a level of assurance. I have no idea whether your parties have that level of need or not. But I can point out that if you want a better grade of cert than Let's Encrypt, you do need to go for the fairly expensive ones that require a lot of real, human validation. There's not much point in just getting another cheap-but-not-free cert that has roughly the same level of validation.

3. There's another solution to this problem entirely, if you're communicating between two parties and that's all this cert is doing (i.e., you're not speaking to the general public with this cert). Make your own certificate authority, sign your own certs, have the public key of that CA inserted into the Java cert authority.

Creating your own certificate authority is very simple. To give you a sense of how simple, here's some scripts I bashed together to set up nodes that speak to each other over SSL: Set up the CA [1] Build a new cert signed by that CA for the node [2].

I am NOT saying you can just use those or that you should even crib from them. These are generally intended for quick reference and testing only even in the context of this project ("real" users are expected to do their own cert management with real certs), and the needs of this project are significantly different from an HTTPS website. My intent in linking those is merely to demonstrate the rough complexity of setting up a CA is only a few lines in bash, not a monstrous impossibly-large undertaking, and you can Google this stuff up in a day or two, tops. The hard part is all around how careful you are with the private keys and revocation, and the fact you must set up and implement your own security policies around the certs. (My suggested revocation policy would be "we'll call you", and that if a cert is ever compromised, just re-roll the whole process from start to finish and create a new CA. "Real" revocation is somewhat complicated, and somewhat unsatisfactory anyhow. Take advantage of the smallness of the problem and the pre-existing personal connections. A lot of the at-scale SSL issues arise because we don't have those.)

[1]: https://github.com/thejerf/reign/blob/master/create_signing_...

[2]: https://github.com/thejerf/reign/blob/master/create_node_cer...