Detent Point

SqlCertForge TLS certificate binding for SQL Server and Reporting Services

Set-RsCertBinding

Binds a TLS certificate to a Reporting Services HTTPS endpoint the RS-native way — updating RS config and HTTP.sys together, with a -Force path that replac...

Domain: SSRS / PBIRS · Risk: Changes state · Runs on: Windows, PowerShell 5.1 or 7

This attaches the certificate to the report server’s web endpoint. It uses Reporting Services’ own configuration interface, so the two places a binding lives — RS configuration and the Windows HTTP layer — stay in agreement. When an old, conflicting certificate is already in place, -Force replaces it cleanly.

Calls CreateSSLCertificateBinding on the RS WMI configuration class — updating rsreportserver.config and the HTTP.sys binding atomically. The RS service must be restarted to apply (caller’s responsibility). Never throws; the RS instance is located automatically (no hard-coded version integer).

Recipe 01 — Bind on a SSRS 2017+ instance

Set-RsCertBinding -Thumbprint 'A1B2C3…A1B2' -RsInstance 'SSRS'

Binds to the web service endpoint on port 443.

Recipe 02 — The web portal on PBIRS, on a remote server

Set-RsCertBinding -Thumbprint 'A1B2C3…A1B2' -RsInstance 'PBIRS' `
    -Application ReportServerWebApp -Port 443 -ComputerName RSSERVER01 -Credential (Get-Credential)

Recipe 03 — Replace a conflicting binding

Set-RsCertBinding -Thumbprint $newTp -RsInstance 'SSRS' -Force

Without -Force, a different cert already bound to that IP:port returns Failed with a hint. With it, the old binding is removed via the RS API and the new cert bound.

Watchpoint — the SSL binding at an IP:port is shared. Every RS application bound there uses the same certificate, so -Force re-binds the new cert for all applications on that IP:port, not just the one named.

“Binding” a certificate means telling the web endpoint: use this certificate to prove who you are and to encrypt traffic. Reporting Services stores that in two places, and they must match. This command writes both through the official RS interface, so they can’t drift apart.

If a different certificate is already bound to the same address and port, the command stops and tells you — unless you pass -Force, which replaces it. After binding, restart the RS service for it to take effect.

Question Answer
Outbound calls? None. A WMI call to the local (or named) RS server.
What it changes The SSL certificate binding for the endpoint (RS config + HTTP.sys).
Privileges RS admin + local admin; WinRM for remote.
Manual-netsh avoided Yes, including the conflict-replace path.
Dependency Why Required?
SSRS 2016+ or PBIRS The service being configured. Yes
The certificate in LocalMachine\My, not expired The cert being bound. Yes
An RS service restart The binding takes effect on restart. Yes
  • Writes through the official RS configuration API, keeping config and HTTP.sys atomically consistent — no netsh side-channel to reconcile.
  • The shared-IP:port behaviour is documented and surfaced, so a -Force replacement’s full effect is understood rather than a surprise.
  • Refuses to silently overwrite a conflicting binding without -Force, keeping certificate replacement an explicit, auditable action.