Forum Discussion
Power BI Report Server Cannot Create SSL Certificate Binding on Windows Server 2025
Hello,
I am trying to configure HTTPS for Power BI Report Server on a Windows Server 2025 machine.
Environment:
- Power BI Report Server (latest available version)
- Windows Server 2025
- SSL certificate installed under Local Computer > Personal > Certificates
- Certificate has a valid private key
- Certificate subject: *.imidro.gov.ir
- Port 443 is available and not currently bound to another service
Issue:
When configuring HTTPS in Report Server Configuration Manager, the URL reservation succeeds, but certificate binding fails.
Configuration Manager log:
Create certificate binding.
We were unable to create the certificate binding.
Reserving url https://+:443
The url was successfully reserved.
The specified url was unexpectedly reserved. The previous reservation has been overridden.
Additional troubleshooting performed:
1. Verified that the certificate contains a private key:
"You have a private key that corresponds to this certificate."
2. Checked SSL bindings:
netsh http show sslcert
No existing SSL bindings were found.
3. Verified port 443:
No process is listening on TCP 443.
4. Certificate verification:
certutil -verifystore my
Output includes:
Incomplete certificate chain
Cannot find certificate:
CN=Certum Domain Validation CA SHA2
5. Certificate Path tab shows:
The issuer of this certificate could not be found.
Questions:
- Can an incomplete certificate chain cause Power BI Report Server to fail during SSL certificate binding?
- Does PBIRS require the full certificate chain (Intermediate and Root CA certificates) to be installed before creating the binding?
- Has anyone successfully configured HTTPS on Windows Server 2025 with a similar setup?
Any guidance would be appreciated.
Thank you.
Hi MahsaTavana
I am not fully certain, but based on the information provided, the issue is very likely caused by the incomplete certificate chain, and not by Power BI Report Server or Windows Server 2025 itself.
Key points addressing your questionsCan an incomplete certificate chain cause HTTPS binding to fail in PBIRS?
Yes. An incomplete certificate chain can and does cause SSL binding failures. Even if the certificate:
Is installed correctly,
Has a valid private key,
And the URL reservation succeeds,the SSL binding step can fail if Power BI Report Server cannot validate the full trust chain up to a trusted root certificate.
Does Power BI Report Server require the full certificate chain?
Yes. Power BI Report Server relies on Windows HTTP.sys for SSL binding. HTTP.sys requires the full certificate chain to be resolvable at the machine level. This means:
The leaf certificate must be in Local Computer > Personal
The intermediate CA certificate(s) must be in Local Computer > Intermediate Certification Authorities
The root CA certificate must be in Local Computer > Trusted Root Certification AuthoritiesYour certutil -verifystore my output and the Certificate Path error clearly indicate that the intermediate CA (Certum Domain Validation CA SHA2) is missing. This breaks chain validation and prevents binding.
Is Windows Server 2025 a known blocker?
No. There is no known limitation specific to Windows Server 2025 regarding HTTPS configuration for Power BI Report Server. The behaviour you are seeing is consistent with:
HTTP.sys certificate validation rules
PBIRS SSL binding requirements on previous Windows Server versions as wellWhat is most likely happening
URL reservation succeeds because it does not validate certificates.
Certificate binding fails because HTTP.sys cannot build a trusted certificate chain.
PBIRS reports a generic binding failure, even though the root cause is certificate trust.Recommended next steps
Obtain the intermediate CA certificate for
Certum Domain Validation CA SHA2
Install it into:
Local Computer > Intermediate Certification Authorities
Verify that the root CA is trusted.
Reopen Report Server Configuration Manager and retry the HTTPS binding.Once the chain is complete, the certificate binding step should succeed without further changes.
Additional note on wildcard certificates
Wildcard certificates (such as *.imidro.gov.ir) are supported by Power BI Report Server as long as the hostname used to access the server matches the wildcard pattern exactly.Conclusion
Yes, an incomplete certificate chain is sufficient to cause the SSL binding failure you are seeing. Power BI Report Server requires the full chain (leaf, intermediate, and root) to be installed at the machine level before HTTPS configuration can complete successfully.
DISCLAIMER: While I wrote a draft of this answer, I used Copilot to create a longer, more detailed step-by-step description to make it easier to apply.
3 Replies
- ZanquetaSuper User
Hi MahsaTavana
I am not fully certain, but based on the information provided, the issue is very likely caused by the incomplete certificate chain, and not by Power BI Report Server or Windows Server 2025 itself.
Key points addressing your questionsCan an incomplete certificate chain cause HTTPS binding to fail in PBIRS?
Yes. An incomplete certificate chain can and does cause SSL binding failures. Even if the certificate:
Is installed correctly,
Has a valid private key,
And the URL reservation succeeds,the SSL binding step can fail if Power BI Report Server cannot validate the full trust chain up to a trusted root certificate.
Does Power BI Report Server require the full certificate chain?
Yes. Power BI Report Server relies on Windows HTTP.sys for SSL binding. HTTP.sys requires the full certificate chain to be resolvable at the machine level. This means:
The leaf certificate must be in Local Computer > Personal
The intermediate CA certificate(s) must be in Local Computer > Intermediate Certification Authorities
The root CA certificate must be in Local Computer > Trusted Root Certification AuthoritiesYour certutil -verifystore my output and the Certificate Path error clearly indicate that the intermediate CA (Certum Domain Validation CA SHA2) is missing. This breaks chain validation and prevents binding.
Is Windows Server 2025 a known blocker?
No. There is no known limitation specific to Windows Server 2025 regarding HTTPS configuration for Power BI Report Server. The behaviour you are seeing is consistent with:
HTTP.sys certificate validation rules
PBIRS SSL binding requirements on previous Windows Server versions as wellWhat is most likely happening
URL reservation succeeds because it does not validate certificates.
Certificate binding fails because HTTP.sys cannot build a trusted certificate chain.
PBIRS reports a generic binding failure, even though the root cause is certificate trust.Recommended next steps
Obtain the intermediate CA certificate for
Certum Domain Validation CA SHA2
Install it into:
Local Computer > Intermediate Certification Authorities
Verify that the root CA is trusted.
Reopen Report Server Configuration Manager and retry the HTTPS binding.Once the chain is complete, the certificate binding step should succeed without further changes.
Additional note on wildcard certificates
Wildcard certificates (such as *.imidro.gov.ir) are supported by Power BI Report Server as long as the hostname used to access the server matches the wildcard pattern exactly.Conclusion
Yes, an incomplete certificate chain is sufficient to cause the SSL binding failure you are seeing. Power BI Report Server requires the full chain (leaf, intermediate, and root) to be installed at the machine level before HTTPS configuration can complete successfully.
DISCLAIMER: While I wrote a draft of this answer, I used Copilot to create a longer, more detailed step-by-step description to make it easier to apply. - v-prasareCommunity Support
Hi MahsaTavana
We would like to confirm if our community members answer resolves your query or if you need further help. If you still have any questions or need more support, please feel free to let us know. We are happy to help you.
Zanqueta ,Thanks for your prompt responseThank you for your patience and look forward to hearing from you.
Best Regards,
Prashanth Are
MS Fabric community support - v-prasareCommunity Support
Hi @MahsaTavana
We would like to confirm if our community members answer resolves your query or if you need further help. If you still have any questions or need more support, please feel free to let us know. We are happy to help you.Thank you for your patience and look forward to hearing from you.
Best Regards,
Prashanth Are
MS Fabric community support