Is SharePoint 2019 and SPSE Supports to Bind the SSL Certificate for or Enable HTTPS for SharePoint WebService?

SharePoint Server 2019 and SharePoint Server Subscription Edition support HTTPS for service-application communication on TCP 32844; configure it through SharePoint’s service-application publishing and service-host settings rather than manually changing the IIS binding.

Configure the service application for HTTPS

SharePoint uses these service-application endpoints:

• HTTP: TCP 32843
• HTTPS: TCP 32844
• Third-party net.tcp: TCP 32845

The protocol can be selected separately for each published service application. In Central Administration → Application Management → Manage service applications, select the service application, choose Publish, and select HTTPS. This guidance applies to both SharePoint 2019 and Subscription Edition.^1^

Also configure the SharePoint service host with the certificate and secure port. Run the relevant command from the SharePoint Management Shell as an account with the required SharePoint and local permissions:

$settings = Get-SPServiceHostConfig

Set-SPServiceHostConfig `
    -Identity $settings `
    -HttpsPort 32844 `
    -SslCertificateThumbprint "<certificate-thumbprint>" `
    -SslCertificateStoreName "My" `
    -WhatIf

Review the -WhatIf output, remove -WhatIf, and run the command to apply it. Alternatively, the certificate can be supplied as an X509Certificate2 object through -ImportSslCertificate. The SharePoint 2019 cmdlet explicitly supports -HttpsPort, -SslCertificateThumbprint, and -ImportSslCertificate.^2^

Subscription Edition provides the equivalent service-host configuration syntax:^3^

Set-SPServiceHostConfig `
    -Identity $settings `
    -HttpsPort 32844 `
    -SslCertificateThumbprint "<certificate-thumbprint>" `
    -SslCertificateStoreName "My"

Before applying it, ensure the certificate:

• Is installed with its private key on the applicable SharePoint servers.
• Is trusted by every farm or consuming server that connects to the service.
• Is valid for the name used to reach the service endpoint.

Afterward, verify that:

1. The service application is published using HTTPS.
2. TCP 32844 is allowed only between the SharePoint servers or consuming farms that require it.
3. Service-application consumers remain connected and no certificate or TLS errors appear in ULS logs.

SharePoint 2019 and Subscription Edition both support TLS for SharePoint Server connections.^4^

HSTS on port 32844 is a separate issue

Enabling HTTPS does not automatically imply HSTS. HSTS is an HTTP response header interpreted by browsers or other compliant user agents; after receiving it over HTTPS, the client remembers to use HTTPS for that host.^5^

The available SharePoint documentation confirms HTTPS support for service applications on port 32844, but it does not document an end-to-end supported procedure or requirement for adding the Strict-Transport-Security header to this internal SharePoint service endpoint. Therefore:

• Configure HTTPS on 32844 if encryption of service-application traffic is required.
• Do not manually add an IIS binding or modify the SharePoint Web Services IIS site solely to satisfy an HSTS scanner finding; use Publish and Set-SPServiceHostConfig so SharePoint owns the configuration.
• If the scanner reports “HSTS missing” on https://server:32844, ask the security team to evaluate that finding as an internal, non-browser service endpoint. HSTS does not create encryption; the HTTPS binding and certificate provide transport encryption.
• Continue using HSTS on user-facing SharePoint web applications that are intended to be HTTPS-only. IIS supports site-level HSTS on IIS 10 version 1709 and later.^6^

For SPSE user-facing web applications, SSL certificates and IIS bindings can be managed through Central Administration → Application Management → Manage web applications → select application → Edit, but that SPSE-only facility concerns web applications, not the internal service-application endpoint.^7^

References

1. Plan security hardening for SharePoint Server
2. Set-SPServiceHostConfig-Syntax
3. Set-SPServiceHostConfig-Syntax
4. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocol support in SharePoint Server
5. Security Frame: Communication Security | Mitigations
6. IIS 10.0 Version 1709 HTTP Strict Transport Security (HSTS) Support
7. Update a web application URL and IIS bindings for SharePoint Server Subscription Edition