Errors setting up WinRM over HTTPS

J R 1 Reputation point
2020-11-12T19:44:35.127+00:00

I get the following error when trying to configure WinRM over HTTPS:

PS C:\Windows\system32> winrm quickconfig -transport:https
WinRM service is already running on this machine.
WSManFault
Message
ProviderFault
WSManFault
Message = Cannot create a WinRM listener on HTTPS because this machine does not have an appropriate cert
ificate. To be used for SSL, a certificate must have a CN matching the hostname, be appropriate for Server Authenticatio
n, and not be expired, revoked, or self-signed.
Error number: -2144108267 0x80338115
Cannot create a WinRM listener on HTTPS because this machine does not have an appropriate certificate. To be used for SS
L, a certificate must have a CN matching the hostname, be appropriate for Server Authentication, and not be expired, rev
oked, or self-signed.
PS C:\Windows\system32>

The certificate I am using is not expired, includes server authentication, shows as OK in Certification Path, and the hostname of the server matches the "Issued To:" on the certificate. So I don't know why I am getting this error.

Additionally, in the first command below, the thumbprint for the cert is displayed, but in the second command, no certificate thumbprint is displayed.

Any help is greatly appreciated.

*PS C:\Windows\system32> winrm e winrm/config/listener
Listener
Address = *
Transport = HTTPS
Port = 5986
Hostname = XXXXXXXXXX
Enabled = true
URLPrefix = wsman
CertificateThumbprint = 1B4288BCD2387008B894F459B78DE9C6576AE039
ListeningOn = 20.20.149.39, 127.0.0.1
Listener [Source="GPO"]
Address = *
Transport = HTTP
Port = 5985
Hostname
Enabled = true
URLPrefix = wsman
CertificateThumbprint
ListeningOn = x.x.x.x, 127.0.0.1
PS C:\Windows\system32> Winrm get http://schemas.microsoft.com/wbem/wsman/1/config
Config
MaxEnvelopeSizekb = 500
MaxTimeoutms = 60000
MaxBatchItems = 32000
MaxProviderRequests = 4294967295
Client
NetworkDelayms = 5000
URLPrefix = wsman
AllowUnencrypted = false
Auth
Basic = true
Digest = true
Kerberos = true
Negotiate = true
Certificate = true
CredSSP = false
DefaultPorts
HTTP = 5985
HTTPS = 5986
TrustedHosts
Service
RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)
MaxConcurrentOperations = 4294967295
MaxConcurrentOperationsPerUser = 1500
EnumerationTimeoutms = 240000
MaxConnections = 300
MaxPacketRetrievalTimeSeconds = 120
AllowUnencrypted = false
Auth
Basic = false
Kerberos = true
Negotiate = true
Certificate = false
CredSSP = false
CbtHardeningLevel = Relaxed
DefaultPorts
HTTP = 5985
HTTPS = 5986
IPv4Filter = * [Source="GPO"]
IPv6Filter [Source="GPO"]
EnableCompatibilityHttpListener = false
EnableCompatibilityHttpsListener = false
CertificateThumbprint
AllowRemoteAccess = true [Source="GPO"]
Winrs
AllowRemoteShellAccess = true
IdleTimeout = 7200000
MaxConcurrentUsers = 2147483647
MaxShellRunTime = 2147483647
MaxProcessesPerShell = 2147483647
MaxMemoryPerShellMB = 2147483647
MaxShellsPerUser = 2147483647*

Windows Server Management
Windows Server Management
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Management: The act or process of organizing, handling, directing or controlling something.
424 questions
Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,446 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Eleven Yu (Shanghai Wicresoft Co,.Ltd.) 10,706 Reputation points Microsoft Vendor
    2020-11-13T08:12:20.573+00:00

    Hi,

    From the command result below, it shows the certificate authentication is false.
    Please follow the guidance in below article to enable the certificate authentication and see if the issue could be resolved or not.
    https://video2.skills-academy.com/en-us/windows/win32/winrm/authentication-for-remote-connections#enabling-or-disabling-authentication-options

    Auth
    Basic = false
    Kerberos = true
    Negotiate = true
    Certificate = false
    CredSSP = false
    CbtHardeningLevel = Relaxed

    Thanks,
    Eleven

    ----------

    If the Answer is helpful, please click "Accept Answer" and upvote it. Thanks.

    1 person found this answer helpful.