171

After setting up HTTPS in IIS Express, according to such articles as this and this, I am unable to actually load an IIS Express site using HTTPS. In Chrome, I am only getting:

This webpage is not available (with error code "ERR_CONNECTION_RESET")

...and in IE I am only getting:

Internet Explorer cannot display the webpage

...when I follow the directions in those articles.

It appears this has to do with the fact that the "IIS Express Development Certificate" that IIS Express installs automatically has been removed. How do I get this certificate reinstalled?

Chris Simmons
  • 6,924
  • 5
  • 31
  • 47
  • 2
    Also happened to me trying to run IISExpress on port 443 (or actually on any port outside the 44300-44399 range) – Gerardo Grignoli Jul 12 '16 at 03:02
  • Note: the accepted answer to this question is applicable even where the IIS Express localhost certificate is present and appears to be fine. – haymansfield Aug 02 '16 at 08:37
  • For Visual Studio 2017 see https://stackoverflow.com/questions/44142037/re-installing-visual-studio-2017-localhost-certificate/45194588 – RickAndMSFT Jul 19 '17 at 15:22

9 Answers9

239

Windows 10 users: Repair is only in the Control Panel, not in the Add Remove programs app. I typically run appwiz.cpl to launch the old control panel applet and run repair from there.

Windows 7 and 8.1: After going to Add/Remove Programs and choosing the "Repair" option on IIS Express, the certificate has been reinstalled and I can now launch IIS Express sites using HTTPS.

Repair IIS Express

The certificate is back:

IIS Express Development Certificate

And I can now launch the IIS Express site using HTTPS:

Success!

RickAndMSFT
  • 20,912
  • 8
  • 60
  • 78
Chris Simmons
  • 6,924
  • 5
  • 31
  • 47
  • 1
    Works for me too, but in my case the certificate was there. Not sure why, but that resulted in same error. So i've removed certificate, and 'repair' reinstalled this back, and voila. Thanks alot. – Darius Sep 30 '14 at 08:14
  • 50
    Note for Windows 10 users: Repair is only in the Control Panel, not in the Add Remove programs app. Brilliant idea msft. – Chris Weber Apr 04 '16 at 00:51
  • 1
    A much quicker way is to launch Jexus Manager and generate a new certificate and then bind to your site. http://jexusmanager.com Of course it does not yet fix broken certificate bindings and I will see how to make that a one-click feature. – Lex Li Jun 30 '16 at 15:13
  • The repair works but I had to delete any existing certificates using MMC. The problem I ran into was that I was not deleting them as admin from localMachine. Make sure you run MMC with elevated permissions! – ranieuwe Aug 16 '16 at 14:22
  • 15
    Note for VS2019 users: "Repair" will not work because the Visual Studio Installer does not put the MSI file where Control Panel expects it to be. However, there is a `_package.json` file in that same directory, and it contains the URL of the MSI file. You may either run that manually or copy it to where Control Panel expects it. – Chris R. Donnelly Jul 18 '19 at 20:58
  • 2
    Repair on IIS Express does not appear to be working for me. I'm using Visual Studio 2019, but I wasn't able to find the correct MSI to run it manually. – FishBasketGordo Feb 22 '20 at 17:57
  • @ChrisR.Donnelly I know that this is an old comment, but could you please tell me what I should do to repair the IIS 10 if I have VS 2019. Thanks – Itsme1 Aug 26 '20 at 17:10
  • @Itsme1 - I have VS2019 and just used Chris's method to repair IIS 10.0 Express. It's convoluted but it works. I downloaded the msi file to any folder and pointed "Repair" at that folder when it couldn't find it in its normal place. During the repair, the "localhost" cert appeared under Personal Certificates. – John Pankowicz Apr 02 '21 at 13:56
  • "It's convoluted but it works." Sounds about right! :) – Chris Simmons Apr 02 '21 at 18:44
  • I'm on Win10 but had to use the normal add/remove programs, not the old one. The old one said the file couldn't be found. I also only had the "uninstall" option, not "repair", so I had to uninstall and reinstall IIS Express 10. That fixed it. – David Klempfner Nov 25 '21 at 23:07
213

For Visual Studio 2015, IIS Express 10, Windows 10, these options didn't work for me. IIS Express 10 didn't have a repair option.

I managed to solve the problem using the IisExpressAdminCmd.exe command available at C:\Program Files (x86)\IIS Express.

From an elevated command prompt run:

cd 'C:\Program Files (x86)\IIS Express'
IisExpressAdminCmd.exe setupsslUrl -url:urlToYourSite -UseSelfSigned

Replacing urlToYourSite with your url.

e.g.

cd 'C:\Program Files (x86)\IIS Express'
IisExpressAdminCmd.exe setupsslUrl -url:https://localhost:44387/ -UseSelfSigned

After that I closed IIS Express and restarted my site from Visual Studio and it prompted to automatically trust the self-signed certificate.

Bernie White
  • 4,780
  • 4
  • 23
  • 21
  • 3
    This worked for me trying to run IISExpress on port 443. +1 – Gerardo Grignoli Jul 12 '16 at 03:04
  • This solution worked great for me. Windows 10, Visual Studio 2015, IIS Express 10. – Glenn Mar 03 '17 at 19:09
  • This is still the case in VS2017 Community. I had to run this command in order to get a default MVC5/Web Api 2 site to pull up when I changed from http to https, using IIS Express 10 on Windows 10. Thank you for posting I would have never figured this out on my own. – John Ernest Apr 04 '17 at 17:16
  • Thanks. This works for me. But just want to know is there any permanent solution for all the application. Because if I create a new project I need to do the same again. Is uninstalling and installing again the solution? – Kishan Choudhary Apr 28 '17 at 15:59
  • 1
    If anyone here is having problems getting a specific port used by IIS Express, you might want to check if someone has a site registered in IIS using that port. That was my day today. – Chris Marisic May 23 '17 at 18:55
  • 2
    In Windows 10, IIS Express *has* a repair option. You need to go through Control Panel. Accepted answer worked for me. – joerage Jun 01 '17 at 15:11
  • 1
    In case you are tired of using command line, you can use Jexus Manager to do the same, https://blog.lextudio.com/why-chrome-says-iis-express-https-is-not-secure-and-how-to-resolve-that-d906a183f0 – Lex Li Jun 15 '17 at 04:13
  • Worked with Windows 10 / VS2019 / IIS Express 10. Reinstall did not suffice. – Geralt Aug 13 '20 at 12:47
  • I was having trouble getting IIS Express to allow me to run projects locally in VS2019 with different ports; this did the trick. I was able to add each url with its port and when the site ran on its port, I didn't get any more errors. – gware Aug 17 '20 at 17:39
  • Worked for me in my SharePoint development machine when Central Admin stopped responding (ERR_CONNECTION_RESET) – rlv-dan May 21 '21 at 08:03
  • Worked for ERR_CONNECTION_RESET in ASP.NET CORE (.NET 5.0), Visual Studio 2019, didn't even need to restart VS, just preessed F5 in the Browser during the same debugging session. Thanks, thats very helpful (https://i.imgur.com/jQYUw0l.png). – rvnlord Oct 14 '21 at 20:25
  • It worked for VS2019 community edition , IIS 10 and windows 10 – Ashu Mar 16 '22 at 07:50
45

Also note that for IIS Express to work with SSL, the port used needs to be in the 44300 through 44399 range (http://www.iis.net/learn/extensions/using-iis-express/running-iis-express-without-administrative-privileges).

So, if you're using IIS Express in Visual Studio, make sure the port selected is in the required range: vs setting for iis express

Shiraz
  • 2,310
  • 24
  • 26
  • 3
    I was able to use a port outside this range after using the command in Bernie White's answer without any problems. Windows 10 / Visual Studio Community 2015 / .Net Core 1.0.1 / IIS Express 10.0 – Ryan Thomas Oct 03 '16 at 02:17
  • 1
    Thanks! This solved the issue for me. Weird that Visual Studio doesn't warn about that. – Erwin Mayer Nov 03 '16 at 04:12
  • 4
    44300-44399 is just the default port range with a certificate mapped. You can easily create similar certificate mapping by calling `netsh`, or simply use Jexus Manager, https://blog.lextudio.com/why-chrome-says-iis-express-https-is-not-secure-and-how-to-resolve-that-d906a183f0 – Lex Li Jun 15 '17 at 04:10
42

Sometimes this error is because of a different certificate installed for localhost. If that is the case, there is no need to restore the IIS Express certificate. Instead, you can do the following to tell IIS Express to use your existing certificate:

  1. Open the Certificates MMC snap-in as described here
  2. Find your localhost certificate e.g. under Personal...Certicates and get its thumbprint:
    1. Bring up the properties dialog for the localhost certificate and find the Thumbprint property
    2. Paste the thumbprint value into Notepad (or whatever) and remove the spaces and any special characters at the beginning
  3. Find the port value of your IIS Express project:
    1. Go to the project properties in Visual Studio and finding the "SSL URL" value, e.g. "https://localhost:44300/MyApp".
    2. In this example 44300 is the port number. If yours is different, change that value in the later commands.
  4. Use the following commands in an administrative command prompt (not Powershell):

netsh http delete sslcert ipport=0.0.0.0:44300

netsh http add sslcert ipport=0.0.0.0:44300 certhash=your_cert_hash_with_no_spaces appid= {123a1111-2222-3333-4444-bbbbcccdddee}

The Guid in the above command can be replaced with one that you generate. It does not correspond to any existing IIS Express value.

For further reference see Handling URL Binding Failures in IIS Express.

explunit
  • 18,967
  • 6
  • 69
  • 94
  • 2
    A more visual way is to use Jexus Manager, https://blog.lextudio.com/why-chrome-says-iis-express-https-is-not-secure-and-how-to-resolve-that-d906a183f0 then you don't have to remember the details like certificate hash. – Lex Li Jun 15 '17 at 04:14
  • if you get "The parameter is incorrect." error - use this appid first then certhash. Example: netsh http add sslcert ipport=0.0.0.0:44300 appid={C21B9F4D-2A5D-4160-81C8-FBCC3EFC335E} certhash=your_cert_hash_with_no_spaces – gmsi Jan 17 '20 at 16:41
16

With new Chrome 58, nothing from the answers below will help. I've just spent 1 hour uninstalling / reinstalling certificates and trying to find out where the problem is.

Apparently Chrome 58 will refuse certificate because "missing_subjectAltName"

The solution is either "badidea" passphrase or if you need to open popups for login you have to use:

chrome://flags/#allow-insecure-localhost

The source is and the upvote belongs to: https://stackoverflow.com/a/38926117/2089232 :)

Uwe Keim
  • 39,551
  • 56
  • 175
  • 291
milanio
  • 4,082
  • 24
  • 34
  • 2
    See http://stackoverflow.com/questions/43676993/how-do-i-change-my-iis-express-ssl-certificate-for-one-that-will-work-with-chrom – travis.js Apr 28 '17 at 15:09
  • 1
    Also see https://blog.lextudio.com/why-chrome-says-iis-express-https-is-not-secure-and-how-to-resolve-that-d906a183f0 – Lex Li Jun 15 '17 at 04:15
6

I wanted to add this, because it is ridiculous but maybe it will help someone. Keep in mind that I had never opened my project properties before so I have no idea how this happened (I did not change this myself or have the opportunity to), but in Project > Properties > Web my SSL url was listed as my usual URL but as http instead of https (had previously been https because it was working before). I went through all the steps listed on this page, uninstalled VS, then IIS, and finally noticed the error which should have been https://mySSLURL (but was missing the s in https). Once I changed http to https everything worked again.

RoboYak
  • 1,352
  • 11
  • 15
3

I just had this issue after updating my VS 2017 to the latest version(s) and created a new (.Net) MVC/WebAPI project (from template). I was able to fix this by adjusting my port numbers to be within the correct range

Chorme Default Port Ranges for DEV SSL

Which I was able to find here: https://www.pluralsight.com/guides/visual-studio-2017-resolving-ssl-tls-connections-problems-with-iis-express

Hope this helps!

Edd
  • 703
  • 7
  • 23
0

You can reinstall IIS Express 10.0 (or whatever version you need) to fix the missing certificate. Download from Microsoft here

TetraDev
  • 16,074
  • 6
  • 60
  • 61
0

In 2023 the official MS docs point to this SO article...Anyway they recommend this:

dotnet dev-certs https --clean

dotnet dev-certs https --trust
Rob
  • 2,363
  • 7
  • 36
  • 54