Okay... guys... figured it out... and it's almost painless.
First, I used this document (https://docs.connectwise.com/ConnectWise_Control_Documentation/On-premises/Advanced_setup/SSL_certificate_installation/Install_and_bind_an_SSL_certificate_on_a_Windows_server) for the manual installation of an SSL with ScreenConnect/ConnectWiseControl.
Second, I used letsencrypt-win-simple (version 1.9.3). You can get that here (https://github.com/Lone-Coder/letsencrypt-win-simple).
So, here is what we do.
1) Unzip letsencrypt-win-simple.Vx.x.x (whereas x.x.x is the version number) to the desktop or other location (for this, I put it right on my desktop).
2) Run letsencrypt-win-simple from the location you unzipped it into (as administrator).
3) Select "M" for "Generate a certificate manually".
4) Follow the prompts... enter the hostname, enter your email address (if it's the first time running it) and agree to the terms (if it's the first time running it).
5) When prompted for the site path, you will use the installation location of ScreenConnect/ConnectWiseControl. Default is, I believe, "C:\Program Files (x86)\ScreenConnect\" (don't forget the trailing "\" in your path).
** At this point, the script should have made a ".well-known" directory under your ScreenConnect/ConnectWiseControl directory and should have authorized you to get certificates **
6) Once done, you will have some certificates... but, ScreenConnect/ConnectWiseControl isn't using them yet. And, they are in a goofy place.
7) Navigate to %userprofile%\appdata\Roaming\letsencrypt-win-simple which is where your certificates are saved. Letsencrypt-win-simple should have already installed the certificate onto your system in the COMPUTER ACCOUNT certificate store.
8) Now, you need to find the thumbprint of the certificate. You can do it manually (see instructions by ScreenConnect/ConnectWiseControl), if you like, or copy/paste the script below. This will put a document on your desktop called thumbprint.txt
GET THUMBPRINT SCRIPT (edit it for your needs)
--- START ---
const certpath = "%USERPROFILE%\AppData\Roaming\letsencrypt-win-simple\httpsacme-v01.api.letsencrypt.org\[your certificate name].der"
dim objStdOut
dim strLine, resString
set objStdOut = CreateObject("WScript.Shell").Exec("certutil " & certpath).StdOut
while not objStdOut.AtEndOfStream
strLine = objStdOut.ReadLine
if InStr(strLine, "(sha1)") > 0 then resString = trim(split(strLine, ":")(1))
wend
resString = Replace(resString, " ", "")
Set objFSO=CreateObject("Scripting.FileSystemObject")
outFile="%USERPROFILE%\Desktop\thumbprint.txt"
Set objFile = objFSO.CreateTextFile(outFile,True)
objFile.Write resString
objFile.Close
wscript.echo resString
--- END ---
** Now you have a registered email address, a verified domain, certificate files, a certificate thumbprint and an installed certificate (into the COMPUTER ACCOUNT certificate store)
9) Now we need to bind the certificate for ScreenConnect/ConnectWiseControl's web server. As per the documentation we need to run this command line:
--- START ---
netsh http add sslcert ipport=0.0.0.0:443 certhash=[ your thumbprint from the thumbprint.txt file ] appid={00000000-0000-0000-0000-000000000000}
--- END ---
10) Now we need to edit the web.config file, located in the ScreenConnect/ConnectWiseControl directory. You SHOULD MAKE A BACKUP BEFORE YOU EDIT IT.
11) Search for the string "WebServerListenUri" in the web.config file.
12) Edit the line to be
<add key="WebServerListenUri" value="https://+:443/" />
and not (anymore)
<add key="WebServerListenUri" value="http://+:80/" />
13) Save the web.config file.
14) To to services and restart the ScreenConnect Web Server service (you can restart your machine if you like).
That's it.
