Detent Point

SqlCertForge TLS certificate binding for SQL Server and Reporting Services

Test-RsCertBinding

Reports the certificate bound to a Reporting Services endpoint — thumbprint and expiry — and flags HTTP-only mode or an expired cert. Read-only, and free.

Domain: SSRS / PBIRS · Risk: Read-only · Runs on: Windows, PowerShell 5.1 or 7

This tells you which certificate a report server endpoint is using and whether it’s still valid — without changing anything. It also distinguishes “no certificate bound” (the server is running plain HTTP) from “bound but expired,” which is a latent outage. Part of the free tier, so it costs nothing to sweep an estate.

Resolves the RS WMI object, reads the bound thumbprint via ListSSLCertificateBindings, looks the cert up in LocalMachine\My, and checks expiry. Returns Success with Thumbprint=null and an informational Detail when RS has no cert bound (HTTP-only). Returns Failed if RS can’t be found, the bound cert has expired, or a WMI call fails. Never throws.

Recipe 01 — Check the default endpoint locally

Test-RsCertBinding

Default SSRS instance (MSSQLSERVER), ReportServerWebService, local machine.

Recipe 02 — Check the PBIRS web portal

Test-RsCertBinding -RsInstance 'PBIRS' -Application ReportServerWebApp

Recipe 03 — A remote SSRS 2017+ node with credentials

Test-RsCertBinding -RsInstance 'SSRS' -ComputerName $node -Credential $cred

This reads which certificate a report server endpoint is set to use, and when that certificate expires. It never changes anything.

Two useful signals: if nothing is bound, it tells you the endpoint is HTTP-only (not encrypted) — that’s a Success with an “informational” note, not an error. If the bound certificate has already expired, that’s a Failed result — a warning that the site will have certificate problems.

Question Answer
Outbound calls? None. WMI reads on the local (or named) RS server.
What it changes Nothing — read-only.
Privileges RS admin (read); WinRM/-Credential for remote.
Licence Free. Read-only audit needs no licence.
Dependency Why Required?
SSRS 2016+ or PBIRS The service being inspected. Yes
WinRM to remote nodes Only for remote reads. No (local)
  • Cleanly separates HTTP-only (nothing bound) from bound-but-expired, so a report of “not encrypted” is precise rather than ambiguous.
  • Flags an expired endpoint certificate as Failed — surfacing a problem before users hit it.
  • Returns structured data (RsInstance, Application, Thumbprint, ExpiresOn, IsExpired) — audit-ready, no licence required.