Detent Point

SqlCertForge TLS certificate binding for SQL Server and Reporting Services

Set-SsasHttpsBinding

Binds an existing certificate, by thumbprint, to the SSAS msmdpump HTTP.sys IP:port so SSAS-over-HTTP serves HTTPS with it. It binds only — it doesn't issu...

Domain: SSAS HTTPS · Risk: Changes state · Runs on: Windows, PowerShell 5.1 or 7

SQL Server Analysis Services can be reached over HTTP through a component called msmdpump. This command attaches a TLS certificate to that HTTP endpoint so the connection is encrypted. It expects the certificate to already be installed on the machine; it attaches it, it doesn’t create it. If a different certificate is already attached at that address and port, it replaces it.

Binds the certificate (by thumbprint, from LocalMachine\My) to the msmdpump IP:port in HTTP.sys, through the binding seam. It reads the current binding first; already bound to this thumbprint returns Skipped, bound to a different one it rebinds. Supports -WhatIf; never throws. It binds an existing certificate only — it does not issue one — and it covers the msmdpump HTTP endpoint, not the msmdpump/IIS site configuration and not direct-TCP SSAS TLS.

Recipe 01 — Bind on a remote SSAS host

Set-SsasHttpsBinding -Thumbprint A1B2C3... -ComputerName ssas01

Binds the certificate to ssas01’s msmdpump endpoint at the default 0.0.0.0:443.

Recipe 02 — A non-default IP:port, previewed

Set-SsasHttpsBinding -Thumbprint A1B2C3... -IPPort '10.0.0.5:8443' -WhatIf

Shows the bind on a specific IP:port without changing anything.

Watchpoint — an SSL binding at an IP:port is shared. HTTP.sys keys the certificate to the whole IP:port, so rebinding replaces the certificate for everything served at that address and port, not only msmdpump. Binding also doesn’t configure the msmdpump virtual directory itself, nor does it affect direct-TCP (msmdsrv.ini) TLS.

Analysis Services can be published over HTTP by a helper called msmdpump. To serve that over HTTPS, Windows needs to know which certificate to present at the address and port msmdpump listens on. That mapping lives in a part of Windows called HTTP.sys.

This command writes that mapping: it points the IP:port at a certificate you’ve already installed. It doesn’t request or create the certificate, and it doesn’t set up msmdpump itself — it only attaches the certificate to the endpoint.

Question Answer
Outbound calls? None. It reads and writes the HTTP.sys binding on the local (or named) machine.
What it changes The HTTP.sys SSL certificate binding for the msmdpump IP:port — adds it, or replaces the certificate already bound there.
Privileges Local administrator on the target (HTTP.sys binding); WinRM for a remote -ComputerName.
Reversibility Reversible — remove the binding, or rebind the previous thumbprint.
Dependency Why Required?
The certificate installed in LocalMachine\My on the target The binding points at it by thumbprint. Yes
SSAS configured for HTTP access via msmdpump The endpoint this binding secures. Yes
WinRM to the target Only for a remote -ComputerName. No (local)
  • Binds an existing certificate only — it doesn’t issue certificates, so certificate provisioning stays with your PKI or the engine cert-request commands.
  • Idempotent: an IP:port already bound to the named thumbprint is left unchanged and reported as Skipped.
  • Scope is the msmdpump HTTP endpoint; it doesn’t touch the msmdpump site configuration or direct-TCP TLS, so its effect is bounded and documented.
  • -WhatIf shows the bind or rebind before it happens, and the result records whether it bound or rebound.