365 Pro Toolkit serves plain HTTP on port 8082 out of the box. Settings > SSL Certificate turns on HTTPS.
There are two ways to get a certificate onto the server:
- Generate a self-signed certificate. One click, no external dependency, and fine for internal use. Browsers warn that it is not trusted until you install it on the machines that connect.
- Upload your own. A
.pfxfile from your internal certificate authority or a public one. No warnings, as long as the machines connecting already trust the issuer.
Generate a self-signed certificate
- Go to Settings > SSL Certificate and switch Enable HTTPS on.
- Set the HTTPS port. 443 is the default and is what you want unless something else on the server is already using it.
- Leave Certificate set to Generate a self-signed certificate.
- Enter the Hostname. This must be exactly the name people will type in the browser, for example
toolkit.contoso.com. The field is pre-filled with the server's machine name. A certificate issued for the wrong name produces a browser warning on every visit even after you trust it. - Choose how long it is Valid for. Two years is the default.
- Click Generate certificate.
- Click Save, then restart the app.
To get rid of the browser warning, export the certificate and install it in the Trusted Root Certification Authorities store on each machine that connects, which is usually a one-line Group Policy or Intune task.
Upload your own certificate
- Go to Settings > SSL Certificate and switch Enable HTTPS on.
- Set the HTTPS port.
- Set Certificate to Upload a certificate (.pfx).
- Click Choose .pfx file and select the file. It has to be a
.pfxor.p12containing the certificate and its private key. A.ceror.crton its own will not work, because it has no key. - Enter the PFX password, or leave it blank if the file has none.
- Click Import certificate.
- Click Save, then restart the app.
The certificate's subject must match the name people browse to. A wildcard certificate covering that name is fine.
Once imported, the file is stored on the server and the original .pfx is no longer needed.
Restart, and the address afterwards
A change on this page does nothing until the app restarts. Restart the 365 Pro Toolkit Windows service, or the executable if you run it directly.
After the restart the page shows the address to use, for example https://toolkit.contoso.com/, or with the
port appended if you chose something other than 443.
HTTP keeps listening on its original port and redirects to HTTPS. That is deliberate. It means an old bookmark still works, and it leaves a way back in if the certificate ever becomes unusable.
What the certificate card shows
Once a certificate is in place, the page shows it.
| Row | Meaning |
|---|---|
| Subject | The name the certificate was issued to. Must match what people browse to. |
| Issuer | Who issued it. The same as the subject for a self-signed certificate. |
| Valid from | When it became valid. |
| Expires | When it stops working. |
The heading reads Certificate valid or Certificate expired. Check this page occasionally, or put the expiry date in whatever you use to track renewals, because nothing emails you about it.
Renewing or replacing
Replacing a certificate is the same as installing one: generate or upload the new one, save, and restart. The new certificate takes the place of the old, and there is nothing to clean up.
If you are replacing a certificate that has already expired, the toolkit is still reachable over HTTP on its original port, so you can always get to this page.
Turning HTTPS off
Switch Enable HTTPS off, click Save, and restart. The toolkit goes back to serving HTTP only, and the redirect stops.
Troubleshooting
Saved and restarted, but it is still HTTP. The app falls back to HTTP rather than failing to start if HTTPS cannot work, so nothing locks you out. The three causes are a missing certificate, a certificate that will not load, and the HTTPS port being in use by something else. The reason is written to the application log at startup; Settings > Logs shows it.
Port 443 is already in use. Something else on the server is serving HTTPS, usually IIS. Either stop that, or pick another port such as 8443 and include it in the address.
"Generate or upload a certificate before enabling HTTPS." The switch is on but there is no certificate yet. Generate or upload one first, then save.
"That certificate has no private key." The .pfx was exported without its key. Export it again and
include the private key.
"Couldn't import that certificate." Either the password is wrong or the file is not a valid PFX. Check both.
The browser warns that the certificate is not trusted. Expected with a self-signed certificate until you install it in the Trusted Root store on the machines that connect. With a certificate from your own certificate authority, it means that authority's root is not trusted on the connecting machine.
The browser warns that the name does not match. The certificate was issued for a different name than the one being typed, often the machine name rather than the DNS name. Generate or obtain one for the name people actually use.