Is SharePoint 2019 and SPSE Supports to Bind the SSL Certificate for or Enable HTTPS for SharePoint WebService?

adil 1,431 Reputation points
2026-11-10T10:17:31.53+00:00

Hi,We have found below security risk for SharePoint 2019 Servers

The remote web server is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections.

Solution:

Configure the remote web server to use HSTS.

I enable HSTS for web applications but is it support also for web services port 32844 ?

Is SharePoint 2019 Supports to Bind the SSL Certificate for/Enable HTTPS for SharePoint WebService? The SharePoint web service is not binded to HTTPS certificate

Microsoft 365 and Office | SharePoint Server | For business
0 comments

2 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Liora 3,610 Reputation points Independent Advisor
    2026-11-10T11:23:28.4+00:00

    Dear @adil,

    Thank you for the detailed question.

    Based on my understanding of SharePoint Server 2019 and SharePoint Subscription Edition (SPSE), I would be careful about treating this as a standard HSTS configuration issue for a SharePoint Web Application.

    Port 32844 is typically associated with the SharePoint Web Services IIS site, which is used for internal SharePoint service communications rather than end-user access. This differs from SharePoint Web Applications, where enabling HTTPS and configuring HSTS is a common and supported deployment scenario.

    For SharePoint Web Applications, enabling HTTPS and adding the Strict-Transport-Security (HSTS) header is supported and is the recommended approach for browser-facing sites. However, I am not aware of any Microsoft-documented or Microsoft-supported procedure for binding an SSL certificate directly to the SharePoint Web Services endpoint on port 32844 or converting that site to HTTPS solely to address a vulnerability scanner finding.

    Because of that, I would not recommend manually modifying IIS bindings for the SharePoint Web Services site unless Microsoft Support specifically advises doing so. Changes to internal SharePoint service endpoints can have unintended effects on farm communications and may not be preserved across future updates or reprovisioning operations.

    To better assess the finding, could you clarify:

    • Are you running SharePoint Server 2019 or SharePoint Subscription Edition (SPSE)?
    • What is the exact URL reported by the scanner?
    • Is the finding from an internal vulnerability scan (for example, Nessus/Qualys/Rapid7) or from an external penetration test?
    • Is port 32844 accessible only within the SharePoint farm/network, or is it exposed to client devices or external networks?

    If the finding is limited to the internal SharePoint Web Services endpoint on port 32844, this may be an expected product design rather than a missing SharePoint configuration. In that scenario, the most appropriate next step would be to open a Microsoft Support case for SharePoint Server and ask Microsoft to confirm the current supportability and security guidance for the SharePoint Web Services site on port 32844.

    Warm regards,  

    If the answer is helpful, please select "Yes, accept answer". If you have any questions or new updates, please feel free to comment below. 

    Was this answer helpful?

  2. AI answer

    2026-11-10T10:18:31.0466667+00:00

    SharePoint Server 2019 and SharePoint Server Subscription Edition support HTTPS for service-application communication on TCP 32844; configure it through SharePoint’s service-application publishing and service-host settings rather than manually changing the IIS binding.

    Configure the service application for HTTPS

    SharePoint uses these service-application endpoints:

    • HTTP: TCP 32843
    • HTTPS: TCP 32844
    • Third-party net.tcp: TCP 32845

    The protocol can be selected separately for each published service application. In Central Administration → Application Management → Manage service applications, select the service application, choose Publish, and select HTTPS. This guidance applies to both SharePoint 2019 and Subscription Edition.^1^

    Also configure the SharePoint service host with the certificate and secure port. Run the relevant command from the SharePoint Management Shell as an account with the required SharePoint and local permissions:

    $settings = Get-SPServiceHostConfig

Set-SPServiceHostConfig `
    -Identity $settings `
    -HttpsPort 32844 `
    -SslCertificateThumbprint "<certificate-thumbprint>" `
    -SslCertificateStoreName "My" `
    -WhatIf

    Review the -WhatIf output, remove -WhatIf, and run the command to apply it. Alternatively, the certificate can be supplied as an X509Certificate2 object through -ImportSslCertificate. The SharePoint 2019 cmdlet explicitly supports -HttpsPort, -SslCertificateThumbprint, and -ImportSslCertificate.^2^

    Subscription Edition provides the equivalent service-host configuration syntax:^3^

    Set-SPServiceHostConfig `
    -Identity $settings `
    -HttpsPort 32844 `
    -SslCertificateThumbprint "<certificate-thumbprint>" `
    -SslCertificateStoreName "My"

    Before applying it, ensure the certificate:

    • Is installed with its private key on the applicable SharePoint servers.
    • Is trusted by every farm or consuming server that connects to the service.
    • Is valid for the name used to reach the service endpoint.

    Afterward, verify that:

    1. The service application is published using HTTPS.
    2. TCP 32844 is allowed only between the SharePoint servers or consuming farms that require it.
    3. Service-application consumers remain connected and no certificate or TLS errors appear in ULS logs.

    SharePoint 2019 and Subscription Edition both support TLS for SharePoint Server connections.^4^

    HSTS on port 32844 is a separate issue

    Enabling HTTPS does not automatically imply HSTS. HSTS is an HTTP response header interpreted by browsers or other compliant user agents; after receiving it over HTTPS, the client remembers to use HTTPS for that host.^5^

    The available SharePoint documentation confirms HTTPS support for service applications on port 32844, but it does not document an end-to-end supported procedure or requirement for adding the Strict-Transport-Security header to this internal SharePoint service endpoint. Therefore:

    • Configure HTTPS on 32844 if encryption of service-application traffic is required.
    • Do not manually add an IIS binding or modify the SharePoint Web Services IIS site solely to satisfy an HSTS scanner finding; use Publish and Set-SPServiceHostConfig so SharePoint owns the configuration.
    • If the scanner reports “HSTS missing” on https://server:32844, ask the security team to evaluate that finding as an internal, non-browser service endpoint. HSTS does not create encryption; the HTTPS binding and certificate provide transport encryption.
    • Continue using HSTS on user-facing SharePoint web applications that are intended to be HTTPS-only. IIS supports site-level HSTS on IIS 10 version 1709 and later.^6^

    For SPSE user-facing web applications, SSL certificates and IIS bindings can be managed through Central Administration → Application Management → Manage web applications → select application → Edit, but that SPSE-only facility concerns web applications, not the internal service-application endpoint.^7^

    References

    1. Plan security hardening for SharePoint Server
    2. Set-SPServiceHostConfig-Syntax
    3. Set-SPServiceHostConfig-Syntax
    4. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocol support in SharePoint Server
    5. Security Frame: Communication Security | Mitigations
    6. IIS 10.0 Version 1709 HTTP Strict Transport Security (HSTS) Support
    7. Update a web application URL and IIS bindings for SharePoint Server Subscription Edition
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.