Using netsh, bind an SSL certificate to a port num

Question

I have followed the instructions in SSL with Self Hosted WCF Service. When I am trying to bind the certificate on Windows 7 using netsh as described in How to: Configure a Port with an SSL Certificate., it is failing as follows.

In Windows PowerShell

PS C:\> netsh http add sslcert ipport=0.0.0.0:8732 certhash=0000000000003ed9cd0c315bbb6dc1c08da5e6 appid={00112233-4455-6677-8899-AABBCCDDEEFF}
Bad numeric constant: 224.
At line:1 char:104
+ netsh http add sslcert ipport=0.0.0.0:8732 certhash=0000000000003ed9cd0c315bbb6dc1c08da5e6 appid={001 <<<< 12233-4455-6677-8899-AABBCCDDEEFF}
+ CategoryInfo          : ParserError: (224:String) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : BadNumericConstant

In a command prompt

C:\>netsh http add sslcert ipport=0.0.0.0:8732 certhash=0000000000003ed9cd0c315bbb6dc1c08da5e6 appid={00112233-4455-6677-8899-AABBCCDDEEFF}

SSL Certificate add failed, Error: 1312
A specified logon session does not exist. It may already have been terminated.

Answer 1

"Official" (not self signed) certificates (e.g. from Thawte) are imported in the certificate store: „Trusted Root Certification Authorities“.
If no parameter "certstorename=" is passed in the netsh command, netsh takes "MY" what represents the "Private" store.
To bind an official certificate, you have to add:

certstorename=Root

to the netsh command.

Full information

Answer 2

I fought with this forever to get my IIS Express to do SSL properly. It turns out my certificate was in the Trusted Root Certification Authorities store instead of the Personal Certificates store. This is what worked for me:

1. Make sure your certificate is in "Certificates(Local Computer)/Personal/Certificates"
2. netsh http add sslcert ipport=0.0.0.0:8732 certhash=0000000000003ed9cd0c315bbb6dc1c08da5e6 appid='{00112233-4455-6677-8899-AABBCCDDEEFF}'
3. SSL Certificate successfully added
4. Use MMC and drag certificate wherever you want it to go.

Answer 3

We faced the same error and after long hours, we realized that netsh was not browsing all local machine stores to find the certificate identified by the "certhash" parameter. By default, it searches the certificate in the "personal" store and only there.

As our certificate was not in the "personal" store but in the "Trusted Root Certification Authorities" store, the problem was solved by adding the "certstorename" parameter in the netsh command:

C:\>netsh http add sslcert ipport=0.0.0.0:8732 certstorename=AuthRoot certhash=...