Setting Up HTTPS for the ForNAV Report Service

Overview

The service uses Windows HTTP.sys (HttpListener) for both HTTP and HTTPS. HTTPS requires an SSL certificate bound to the listening port via the Windows netsh tool. The service does this automatically on startup, but the certificate must first be imported correctly into the Windows certificate store.

Step 1 — Obtain a Certificate

You need a certificate with a private key in one of these forms:

Self-signed (for internal/testing use) — see below
CA-issued (for production) — obtain a PFX file from your CA

Creating a Self-Signed Certificate (PowerShell)

# Create a certificate in the machine's Personal store
$cert = New-SelfSignedCertificate `
    -DnsName "localhost" `
	-FriendlyName "FORNAV Report Service" `
    -NotAfter (Get-Date).AddYears(5)

# Make a certificate file name
$certfile = "my-root-ca-$($cert.Thumbprint).cer"

# Export the certificate
Export-Certificate `
    -Cert $cert `
    -FilePath $certfile

# Import the certificate in the machine's Trusted Root Certification Authorities store
Import-Certificate `
  -FilePath $certfile `
  -CertStoreLocation "Cert:\LocalMachine\Root"

# Output the thumbprint for the Report Service configuration file
Write-Host "Thumbprint: $($cert.Thumbprint)"

This creates the certificate the machine's Trusted Root Certification Authorities store. It needs to be trusted. Otherwise, Business Central cannot connect to the host if NavHttpClientAntiSSRFEnabled is true in the service tier configuration.

If you have a self-signed certificate, you can skip Step 2.

Step 2 — Import the Certificate

This step is critical. The private key must be stored in the machine key store, not a user profile. Windows services (SYSTEM, NetworkService) have no interactive logon session and cannot access user-profile-stored keys. Importing incorrectly produces netsh error 1312 on service start.

Import a PFX file:

$pw = Read-Host -AsSecureString "PFX password"
Import-PfxCertificate `
    -FilePath "C:\path\to\certificate.pfx" `
    -CertStoreLocation "Cert:\LocalMachine\Root" `
    -Password $pw

Import-PfxCertificate stores the private key in the machine key store by default.

Verify the Import

$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -like "*your-domain*" }
$cert.Thumbprint
$cert.PrivateKey.CspKeyContainerInfo.MachineKeyStore  # must be True

If MachineKeyStore is False, delete the certificate and re-import using the command above.

Step 3 — Configure the Service

Edit the service configuration file:

Location: C:\ProgramData\ForNAV\Report Service\Configuration\Report Service.json

{
  "Url": "https://localhost:9030/ForNavReportService/",
  "CertificateThumbprint": "A1B2C3D4E5F6...",
  "MaxConcurrentRequests": 100,
  "MaxConcurrentTasks": 1,
  "DebugLevel": 0
}

Url — Change http:// to https://. The port can be any available port.
CertificateThumbprint — The thumbprint from Step 1 or 2. Spaces are stripped automatically.

Step 4 — Restart the Service

Restart-Service ForNavReportService

On startup the service runs netsh http add sslcert to bind the certificate to the port. If this succeeds it logs SSL certificate bound for https://... to the Windows Event Log.

Troubleshooting

Check the Windows Event Log under Applications and Services Logs → ForNAV, source Report Service.

Failed to start listener on https://localhost:9030/ForNavReportService/

The event log shows an error similar to this:

netsh failed to bind SSL certificate to 0.0.0.0:9030. Output: SSL Certificate add failed, Error: 5
The requested operation requires elevation (Run as administrator).

Try changing the service user to SYSTEM and restart the service.

Error 1312 — A specified logon session does not exist

The certificate's private key is in a user profile store, not the machine store. Re-import the PFX using Import-PfxCertificate as shown in Step 2.

Error 1312 — After Correct Import

Grant the service account explicit read access to the private key:

Open certlm.msc (Local Machine certificate manager)
Expand Personal → Certificates
Right-click the certificate → All Tasks → Manage Private Keys
Add the service account (NETWORK SERVICE or LOCAL SYSTEM) with Read permission

ERR_CONNECTION_REFUSED in Browser

The service is not listening. Check the Event Log for a startup error. Common causes:

netsh failed (see errors above)
The configuration file has the wrong thumbprint (no certificate found)
CertificateThumbprint is missing from the config

ERR_CERT_AUTHORITY_INVALID in Browser

Expected with self-signed certificates.

Inspect the Current SSL Binding

netsh http show sslcert ipport=0.0.0.0:9030

Remove the SSL Binding Manually

netsh http delete sslcert ipport=0.0.0.0:9030

The service will recreate it on the next startup if the certificate is configured correctly.

Restart the Business Central service tier

Restart-NAVServerInstance -ServerInstance BC

You may need to restart the service tier to force a reload of the certificates.

HTTP Status 0

If you have done everything right, you can still get the following error in Business Central:

Error calling the ForNAV Report Service
HTTP Status 0 NavHttpClient Request Failed
https://localhost:9030/ForNavReportService/

It is not uncommon for the service tier to take some time to find the new trusted certificate. Simply waiting a couple of minutes can fix the problem.

Table of Contents