Detent Point

SqlCertForge TLS certificate binding for SQL Server and Reporting Services

Test-SsasHttpsBinding

Reports the TLS certificate bound to the SSAS msmdpump HTTP.sys IP:port — thumbprint, and the resolved subject and expiry — or that none is bound. Read-onl...

Domain: SSAS HTTPS · Risk: Read-only · Runs on: Windows, PowerShell 5.1 or 7

This checks whether the SSAS HTTP endpoint (msmdpump) has a certificate attached, and which one, without changing anything. It’s the way to confirm SSAS-over-HTTP is serving HTTPS with the certificate you expect.

Reads the HTTP.sys SSL binding for the msmdpump IP:port through the binding seam. When one is bound it resolves the certificate in LocalMachine\My to report its subject and expiry; when none is bound it reports that as a Success, not an error. Covers the msmdpump HTTP endpoint only — direct-TCP TLS (msmdsrv.ini) is out of scope. Never throws.

Recipe 01 — Check a remote SSAS host

Test-SsasHttpsBinding -ComputerName ssas01

Reports whether ssas01’s msmdpump endpoint (0.0.0.0:443) has a certificate bound, and which one.

Recipe 02 — A non-default IP:port

Test-SsasHttpsBinding -IPPort '10.0.0.5:8443'

Watchpoint — subject and expiry need the certificate present locally. The bound thumbprint comes from HTTP.sys, but subject and expiry are resolved by looking that thumbprint up in LocalMachine\My on the target. If the certificate isn’t in that store, the binding still reports as bound, but subject and expiry come back empty.

When SSAS is published over HTTPS, Windows keeps a note of which certificate to present at msmdpump’s address and port. This command reads that note. If a certificate is attached, it shows the thumbprint and — by looking the certificate up in the machine’s store — its subject and expiry date. If nothing is attached, it says so.

It only reads; it changes nothing.

Question Answer
Outbound calls? None. It reads the HTTP.sys binding and the local certificate store on the local (or named) machine.
What it changes Nothing — read-only.
Privileges Rights to read the HTTP.sys binding and the LocalMachine\My store on the target; WinRM for a remote -ComputerName.
Licence Free. Read-only audit commands need no licence.
Dependency Why Required?
Windows + PowerShell 5.1 or 7 Reads the binding and the certificate store. Yes
WinRM to the target Only for a remote -ComputerName. No (local)
  • Read-only — a safe way to confirm the SSAS HTTPS certificate across hosts during a compliance sweep.
  • Reports the bound thumbprint plus the resolved subject and expiry, so an expiring certificate on the endpoint is visible before it lapses.
  • Scope is the msmdpump HTTP endpoint only; direct-TCP TLS is explicitly out of scope, so the report isn’t mistaken for full SSAS TLS coverage.