Export (0) Print
Expand All

Httpcfg Syntax

Updated: March 28, 2003

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

Httpcfg helps you manage the HTTP API.

Httpcfg Syntax

Httpcfg uses the following syntax:

Art Image httpcfg {set | query | delete} {ssl | query | iplisten} [/i Ip:Port] [/h SSL Hash] [/g"{GUID}"] [/c StoreName] [/m CheckMode] [/r RevocationFreshness] [/x UrlRetrievalTimeout] [/t SslCtlIdentifier] [/n SslCtlStoreName] [/f Flags] [/u {http://URL:Port/ | https://URL:Port/}] [/a ACL]

Parameters

"Action" commands are: set, query and delete. They are followed by a set of arguments, ssl, urlacl, and iplisten, which are known as "store" arguments. Depending on the value of action and store, different parameters are then available. For example, the set ssl command may take a different set of parameters than the query ssl command.

  • Art Image httpcfg {action} {store} [parameter]

Action commands

set
Creates a configuration record containing the values specified by the ssl, urlacl, or iplisten argument. This record is then added to the HTTP API configuration store. The call fails if a record with the specified values already exists. To change a given configuration record, you must first delete it, and then recreate it by using set with the updated value(s).

query
Retrieves one or more HTTP API configuration records.

delete
Deletes the specified information, such as IP addresses or SSL certificates, from the HTTP API configuration store, one record at a time.

Store arguments

ssl
Depending on the Action command used, adds (set), queries or deletes SSL certificate meta-information. Such meta-information is maintained by the HTTP API in a metastore, and is used to locate certificates for certificate exchange during HTTPS sessions.

urlacl
Depending on the Action command used, adds (set), queries, or deletes namespace reservations. The HTTP API allows administrators to reserve URI namespaces and protect them with Access Control Lists (ACLs), so that only specified HTTP API clients can use them.

iplisten
Depending on the Action command used, adds (set), queries, or deletes Internet Protocol (IP) addresses in the IP Listen List. If this list is present, the HTTP API listens only to addresses on the list.

httpcfg set ssl

/i Ip:Port
The /i parameter takes a string that specifies the IP-Address:port combination. This serves as the record key identifying the SSL certificate being added. When using set ssl, the /i parameter is required.

/h SSL Hash
The /h parameter takes a string of hexadecimal digits specifying the Thumbprint hash of the certificate being added. This is not a required parameter, however the SSL connection will fail if the hash is invalid.

/g "{ GUID }"
The /g parameter takes a string representing a Globally Unique Identifier (GUID) that identifies the application that added the certificate. In the case of Httpcfg, the GUID must be generated by the user. The enclosing quotation marks and curly braces are required; the /g parameter will not work without them. For more information on generating GUIDs, see Generating Interface UUIDs on the Microsoft Developer Network (MSDN).

/c StoreName
The /c parameter takes a string that specifies the name of the store where the certificate being added resides. If no string is specified, the name "MY" is used by default.

/m CheckMode
The /m parameter takes a string containing one or more numbers representing flags that determine the default mode for checking the certificate. The numbers may consist of one or more of the following flag values:

  • 1 - Client certificate will not be verified for revocation.

  • 2 - Use cached client certificate revocation.

  • 4 - Enable revocation freshness time.

  • 65536 - No usage check.

/r RevocationFreshness
The /r parameter takes a string of numbers that specify the revocation freshness time for the certificate. Revocation freshness represents the number of seconds after which to check for an updated certificate revocation list (CRL). If this value is absent or zero, the new CRL is updated only when the previous one expires.

/x UrlRetrievalTimeout
The /x parameter takes a string of numbers representing the timeout interval, in milliseconds, for retrieving a certificate revocation list from the remote URL.

/t SslCtlIdentifier
The /t parameter takes a string that specifies an SSL control identifier, which restricts the group of certificate issuers to be trusted. This group must be a subset of the certificate issuers trusted by the machine being administered.

/n SslCtlStoreName
The /n parameter takes a string containing the name of the store in which to look up the control identifier specified by the /t parameter.

/f Flags
The /f parameter takes a string containing a number that controls how client certificates are handled. This number may consist of one or more of the following values:

  • 1 - Use DS Mapper.

  • 2 - Negotiate client certificate.

  • 4 - Do not route to raw ISAPI filters.

httpcfg query ssl

/i Ip:Port
The /i parameter takes a string that specifies the IP-Address:port combination. This serves as the record key identifying the SSL certificate being queried. If this parameter is omitted, then the query returns all records in the SSL store.

httpcfg delete ssl

/i Ip:Port
The /i parameter takes a string specifying the IP-Address:port combination. This serves as the record key identifying the SSL certificate to be deleted. When using delete ssl, the /i parameter is required.

httpcfg set urlacl

/u {http://URL:Port/ | https://URL:Port/}
The /u parameter takes a string containing a fully qualified URL that will serve as the record key for the reservation being made. When using set urlacl, the /u parameter is required.

/a ACL
The /a parameter takes a string containing an Access Control List in the form of a Security Descriptor Definition Language (SDDL) string. For more information see Httpcfg Remarks. When using set urlacl, the /a parameter is required.

httpcfg query urlacl

/u URL
The /u parameter takes a string containing a fully qualified URL that identifies the reservation being queried. If no string is specified, the query returns all reservations in the store.

httpcfg delete urlacl

/u URL
The /u parameter takes a string containing a fully qualified URL that identifies the reservation to be deleted. When using delete urlacl, the /u parameter is required.

httpcfg set iplisten

/i Ip:Port
The /i parameter takes a string specifying the IP address to be added to the IP-Listen List. This can be either an IPv4 or IPv6 address. When using set iplisten, the /i parameter is required.

httpcfg query iplisten

/i Ip:Port
The /i parameter takes a string specifying the exact IP address to be queried. If absent, the query returns all addresses in the store.

httpcfg delete iplisten

/i Ip:Port
The /i parameter takes a string specifying the IP address to be deleted from the IP-Listen List. This can be either an IPv4 or IPv6 address. When using delete iplisten, the /i parameter is required.

See Also

Was this page helpful?
(1500 characters remaining)
Thank you for your feedback

Community Additions

ADD
Show:
© 2014 Microsoft