Secure Your Reports: How to Enable SSL/TLS Certificate on SQL Server Reporting Services 2019

SQL Server Reporting Services, commonly known as SSRS, is widely used by organisations to publish business reports, dashboards, operational summaries, financial reports, and customer-facing analytics. Because these reports often contain sensitive business information, securing access to the SSRS web portal is very important.

By default, SSRS may be accessed using HTTP, for example:

http://servername/Reports
http://servername/ReportServer

However, in a production environment, report access should be protected using HTTPS with an SSL/TLS certificate. This ensures that communication between users, browsers, applications, and the SSRS server is encrypted.

This blog explains how to enable an SSL/TLS certificate on SQL Server Reporting Services 2019 in a practical and production-safe way.

Why Enable SSL/TLS on SSRS?

SSRS is often used to display important reports that may contain:

Customer data
Financial information
Sales and revenue reports
Operational reports
Employee information
Management dashboards
Compliance and audit data

If SSRS is accessed over HTTP, traffic between the user’s browser and the report server is not encrypted. This can expose sensitive information to network-level interception.

Enabling SSL/TLS provides several key benefits.

1. Encrypts Report Traffic

SSL/TLS protects data transmitted between the SSRS server and client browsers. This includes login sessions, report parameters, report output, exported files, and portal navigation.

2. Improves Security and Compliance

Many organisations are required to encrypt sensitive data in transit. HTTPS helps meet internal security policies and supports compliance requirements.

3. Builds User Trust

When users access reports through HTTPS, browsers show a secure padlock symbol. This gives users confidence that the reporting portal is protected.

4. Prevents Browser Security Warnings

Modern browsers increasingly warn users when sites use HTTP instead of HTTPS. Configuring SSRS with a valid certificate avoids these warnings.

SSRS SSL/TLS Configuration Overview

To enable HTTPS on SSRS 2019, the high-level process is:

Obtain or create a valid SSL/TLS certificate.
Import the certificate into the local computer certificate store.
Grant the SSRS service account access to the certificate private key.
Bind the certificate to the SSRS Web Service URL.
Bind the certificate to the SSRS Web Portal URL.
Restart and validate SSRS access using HTTPS.

Unlike SQL Server Database Engine encryption, SSRS SSL is configured using Report Server Configuration Manager, not SQL Server Configuration Manager.

Certificate Requirements for SSRS

Before starting, make sure the certificate meets these requirements:

Requirement	Description
Certificate type	SSL/TLS server certificate
Private key	Certificate must include a private key
Store location	Local Computer > Personal
Subject or SAN	Must match the SSRS DNS name
Enhanced Key Usage	Server Authentication
Validity	Certificate must not be expired
Trusted CA	Certificate should be issued by a trusted CA
Service account access	SSRS service account needs read access to the private key

For example, if users will access SSRS using:

https://reports.company.com/Reports

then the certificate should include:

reports.company.com

in the certificate subject or Subject Alternative Name.

Step 1: Import the SSL/TLS Certificate

Open the local computer certificate store:

Windows + R
certlm.msc

Navigate to:

Certificates - Local Computer
> Personal
> Certificates

Import the certificate, usually a .pfx file.

After importing, open the certificate and confirm that it says:

You have a private key that corresponds to this certificate.

If the certificate does not have a private key, SSRS will not be able to use it for HTTPS binding.

Step 2: Grant Private Key Permission to the SSRS Service Account

SSRS must be able to read the certificate private key.

In the certificate store:

Right-click the certificate.
Select All Tasks.
Select Manage Private Keys.
Add the SSRS service account.
Grant Read permission.

Common SSRS service accounts may look like:

NT Service\ReportServer

or:

DOMAIN\svc-ssrs

You can confirm the SSRS service account from:

Report Server Configuration Manager
> Service Account

This step is very important. If the SSRS service account cannot read the private key, the HTTPS configuration may fail or the SSRS service may not work correctly.

Step 3: Open Report Server Configuration Manager

Open:

Report Server Configuration Manager

Connect to your SSRS instance.

For SQL Server Reporting Services 2019, the service name is commonly:

SQL Server Reporting Services

Once connected, you will configure HTTPS for two areas:

Web Service URL
Web Portal URL

Both should be configured if you want the full SSRS environment to work securely over HTTPS.

Step 4: Configure SSL for the Web Service URL

In Report Server Configuration Manager, go to:

Web Service URL

The default virtual directory is usually:

ReportServer

Select the SSL certificate from the HTTPS certificate dropdown.

Set the HTTPS port to:

Then click:

Apply

After applying, SSRS should create an HTTPS URL similar to:

https://reports.company.com/ReportServer

The Web Service URL is used by SSRS internally and by external tools or applications that connect to the report server web service.

Step 5: Configure SSL for the Web Portal URL

Next, go to:

Web Portal URL

The default virtual directory is usually:

Reports

Click:

Advanced

Under HTTPS identities, click:

Add

Select the SSL certificate and set the HTTPS port to:

Click OK, then click Apply.

After configuration, the Web Portal URL should look like:

https://reports.company.com/Reports

This is the main URL users access to view and manage reports.

Step 6: Update UrlRoot if Required

In some environments, SSRS subscriptions, report links, or exported report links may still use the old HTTP URL or server hostname.

To fix this, update the UrlRoot setting.

Open the following file as Administrator:

C:\Program Files\Microsoft SQL Server Reporting Services\SSRS\ReportServer\RSReportServer.config

Before editing, take a backup of the file.

Find:

<UrlRoot>

Update it to the HTTPS Web Service URL:

<UrlRoot>https://reports.company.com/ReportServer</UrlRoot>

Save the file.

This ensures SSRS uses the correct HTTPS URL when generating links.

Step 7: Restart SQL Server Reporting Services

Restart the SSRS service.

You can restart it from:

Report Server Configuration Manager
> Report Server Status

Or use PowerShell:

Restart-Service SQLServerReportingServices

If the service name is different, check it using:

Get-Service | Where-Object {$_.DisplayName -like "*Reporting*"}

Step 8: Validate HTTPS Access

Open a browser and test the Web Service URL:

https://reports.company.com/ReportServer

You should see the SSRS web service page.

Then test the Web Portal URL:

https://reports.company.com/Reports

You should see the SSRS web portal.

Also check the browser padlock and confirm:

Certificate is valid
Issued to: reports.company.com

Step 9: Check HTTP.sys SSL Binding

SSRS uses Windows HTTP.sys for URL and SSL certificate bindings.

To check the SSL binding, open Command Prompt as Administrator and run:

netsh http show sslcert

This will show HTTPS certificate bindings, including the IP address, port, certificate hash, and application ID.

You can also check URL reservations using:

netsh http show urlacl

This is useful when troubleshooting duplicate bindings or port conflicts.

Common Issue: HTTPS Binding Already Exists

A common SSRS SSL error is:

An HTTPS binding already exists for the specified IP address and port combination.
The existing binding uses a different certificate from the current request.
Only one certificate can be used for each IP address and port combination.

This means Windows already has an HTTPS binding for the same IP address and port, usually:

0.0.0.0:443

or:

server-ip-address:443

using a different certificate.

To check the existing binding, run:

netsh http show sslcert

If the server is dedicated to SSRS and the old binding is no longer required, you can remove it using:

netsh http delete sslcert ipport=0.0.0.0:443

If the binding uses a specific IP address, use that IP address instead:

netsh http delete sslcert ipport=192.168.1.20:443

Then return to Report Server Configuration Manager and recreate the HTTPS binding using the correct certificate.

Be careful before deleting SSL bindings. If IIS, Power BI Report Server, Windows Admin Center, or another web application is using port 443, removing the binding may affect that application.

Firewall Requirements

If users access SSRS from other machines, make sure TCP port 443 is allowed through Windows Firewall.

You can create a firewall rule using PowerShell:

New-NetFirewallRule `
  -DisplayName "Allow SSRS HTTPS 443" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 443 `
  -Action Allow

Also confirm that any network firewalls between users and the SSRS server allow HTTPS traffic on port 443.

Best Practices for Production SSRS HTTPS

For a clean and secure production setup, follow these best practices:

Use a certificate issued by a trusted internal or public Certificate Authority.
Avoid self-signed certificates in production.
Use a proper DNS name such as reports.company.com.
Ensure the certificate Subject Alternative Name includes the SSRS DNS name.
Store the certificate in Local Computer > Personal.
Grant private key read permission only to the SSRS service account.
Configure both Web Service URL and Web Portal URL for HTTPS.
Use port 443 unless there is a valid reason to use another port.
Check for existing HTTP.sys bindings before applying changes.
Keep a record of the certificate expiry date.
Test from both the server and a client machine.
Prepare a rollback plan before making production changes.

Rollback Plan

If HTTPS configuration causes issues, you can roll back safely.

Open Report Server Configuration Manager and remove the HTTPS bindings from:

Web Service URL
Web Portal URL

Then restart the SSRS service.

If required, restore the previous RSReportServer.config file from backup.

You can also confirm remaining SSL bindings using:

netsh http show sslcert

Do not delete certificates or HTTP.sys bindings without checking whether they are used by another application.

Final Thoughts

Enabling SSL/TLS on SQL Server Reporting Services 2019 is an important step in securing business reporting environments. SSRS reports often contain sensitive operational, financial, and customer data, so exposing the portal over HTTP is not recommended for production systems.

The key points are simple:

Use a valid certificate
Install it in the correct certificate store
Grant private key access to the SSRS service account
Bind the certificate to both ReportServer and Reports URLs
Validate HTTPS access from client machines

With the right planning and validation, SSRS can be secured with HTTPS safely and reliably. This improves data protection, strengthens compliance, and gives users a secure reporting experience.

Secure Your Reports: How to Enable SSL/TLS Certificate on SQL Server Reporting Services 2019