HTTPS encrypts the connection between people's browsers and AD Pro Toolkit. Without it, the app is served over plain HTTP on port 8083. HTTPS is recommended, and especially if people connect from computers that aren't joined to the domain.
You can turn HTTPS on in two places:
- The setup wizard, with the Enable HTTPS box on its last step. This creates a self-signed certificate.
- Settings > SSL certificate in the app, at any time. Only Super admins can see this page. This is also where you use your own certificate.
Choose a certificate
| Certificate | Browsers trust it | Best for |
|---|---|---|
| From your own certificate authority (for example Active Directory Certificate Services) | Automatically, on domain-joined computers | Most organizations. Recommended. |
| From a public certificate authority | Automatically, everywhere | People connecting from outside your organization's computers. |
| Self-signed, created by AD Pro Toolkit | Only after you install it as trusted on each computer | Testing, or when you have no certificate authority. |
The certificate must be issued to the name people will type in their browser, for example
adtoolkit.contoso.com. A certificate is only valid for the names it was issued to.
Use your own certificate
- Get a certificate for the AD Pro Toolkit computer's name, and export it as a .pfx file with its private key. A .cer file has no private key and won't work.
- In AD Pro Toolkit, go to Settings > SSL certificate and tick Enable HTTPS.
- Leave HTTPS port at 443, unless something else on the computer already uses it.
- Select Upload a certificate, then Choose PFX file…, and pick your file.
- Enter the PFX password, or leave it blank if the file has none.
- Select Use this certificate. The Current certificate panel shows its name and expiry date.
- Select Save and apply.
- Restart AD Pro Toolkit. See Restart to apply.
Use a self-signed certificate
- Go to Settings > SSL certificate and tick Enable HTTPS.
- Select Generate self-signed.
- Enter the Hostname people will use, for example
adtoolkit.contoso.com. - Choose how long it's Valid for.
- Select Generate certificate, then Save and apply.
- Restart AD Pro Toolkit. See Restart to apply.
Browsers will warn that the connection isn't private until the certificate is trusted on the computers people browse from. See Trust a self-signed certificate.
Restart to apply
HTTPS starts when AD Pro Toolkit starts, so after Save and apply, restart the AD Pro Toolkit service. In Services, right-click it and select Restart, or in PowerShell as an administrator:
Restart-Service "AD Pro Toolkit"
Then open the app at https:// and the certificate's name, for example
https://adtoolkit.contoso.com. With port 443 there's no need to add the port.
The old http://...:8083 address keeps working and sends people to the HTTPS address, so existing
bookmarks don't break.
Open the firewall
When HTTPS is turned on in the setup wizard, port 443 is opened in Windows Firewall for you. When you turn it on in Settings > SSL certificate, open the port yourself on the computer AD Pro Toolkit is installed on:
New-NetFirewallRule -DisplayName "AD Pro Toolkit HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow
Trust a self-signed certificate
To stop the browser warnings, install the certificate in Trusted Root Certification Authorities on the computers people browse from. For a domain, Group Policy is the easiest way:
- On the computer AD Pro Toolkit is installed on, open certlm.msc.
- Go to Personal > Certificates, right-click the AD Pro Toolkit certificate, and select All Tasks > Export. Choose No, do not export the private key, and save it as a .cer file.
- In Group Policy Management, edit a policy that applies to the computers people browse from.
- Go to Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Trusted Root Certification Authorities.
- Right-click, select Import, and import the .cer file.
The computers trust the certificate after their next Group Policy refresh.
Turn HTTPS off
Go to Settings > SSL certificate, clear Enable HTTPS, select Save and apply, and restart
AD Pro Toolkit. The app goes back to http://...:8083.
Renew a certificate
The Current certificate panel shows when the certificate expires. Before then, upload a new certificate or generate a new self-signed one, select Save and apply, and restart AD Pro Toolkit.
Troubleshooting
- "That is not a valid PFX file, or the password is wrong": check the password. If the file came from someone else, ask them to export it again as a .pfx.
- "That certificate has no private key": export the certificate again from the computer it was issued on, as a .pfx with the private key.
- A warning that there's no reservation for the HTTPS address: AD Pro Toolkit's service account isn't allowed to use the HTTPS port. Run the command shown in the warning as an administrator, or run the setup wizard again and select Finish setup, which fixes it.
- "The certificate could not be added to the Windows machine store": the service account isn't allowed to install certificates on the computer. This happens when the service runs as a managed service account. Turn HTTPS on from the setup wizard instead.
- The browser says the certificate isn't valid for this site: the address doesn't match the name on the certificate. Use the name the certificate was issued to.
- The HTTPS address doesn't load after restarting: check that port 443 is open in the firewall, and that nothing else on the computer uses it.