"The parameter is incorrect." error using netsh http add sslcert

Question

Following the instructions on "How to: Configure a Port with an SSL Certificate" in this link: http://msdn.microsoft.com/en-us/library/ms733791.aspx, I entered this command on the commandline (duh):

> netsh http add sslcert ipport:10.141.146.227:7001 certhash=5d48e604007b867ae8a69260a4ad318d2c05d8ff appid={EDE3C891-306C-40fe-BAD4-895B236A1CC8}
The parameter is incorrect.

My certhash thumbprint was taken from the certificate in Certificates(Local Computer)>Personal>Certificates folder.

The appid GUID was generated.

What else is wrong that I need to fix to get this to work?

Useful info on calling external programs from PowerShell "the right way" here...http://edgylogic.com/blog/powershell-and-external-commands-done-right/ — andyb, Mar 08 '14 at 21:42
I realized it was all because of my ORDERING! You gotta put `appid` before `certhash`. Its that dumb. — Alexandru, Jul 09 '15 at 15:14
For me, the copy-pasted certhash from windows cert manager had some weird character in front - make sure it's just alphanumeric and there is no weird leading chars. — Jacek Gorgoń, Sep 24 '15 at 14:32
@JacekGorgoń Yes, me too. Probably a [zero-width space](https://en.wikipedia.org/wiki/Zero-width_space). — Uwe Keim, May 18 '17 at 15:58
In my case, I got the "incorrect parameter" error because I included the `certhash` and `appid` values inside single quotes (`'`). After removing the single quotes, everything succeeded. — Uwe Keim, May 18 '17 at 15:59
For me it's was characters in uppercase in the fingerprint... — Wifsimster, Jun 19 '18 at 12:25

score 87 · Answer 1 · edited Sep 11 '17 at 08:41

87

In PowerShell just type as follows. first get into netsh http mode and then add sslcert. It's worked for me.

>netsh

netsh>http

netsh http>add sslcert ipport=0.0.0.0:13286 appid='{a5455c78-6489-4e13-b395-47fbdee0e7e6}' certhash=<thumprint without space>

edited Sep 11 '17 at 08:41

Frederik Struck-Schøning

11,909
7
55
63

answered Jan 10 '11 at 06:51

Abdul Hakim

879
6
2

@abdul-hakim I am trying to add an sslcert using netsh http from within a powershell ps1 file, but it keeps throwing errors when I specify a GUID value for the appid. Here is my code: $guid = [guid]::NewGuid(); netsh http add sslcert ipport=0.0.0.0:443 certhash=$thumb appid={$guid} – user1338998 Mar 04 '13 at 22:08
9

If doing fully on PowerShell command line or a ps1 script remember to quote the curley-braces; else PowerShell will be confused. – codingoutloud Mar 08 '14 at 17:19
3

I realized it was all because of my ORDERING! You gotta put `appid` before `certhash`. Its that dumb. – Alexandru Jul 09 '15 at 15:14
2

@Alexandru -- and I had to not only do that but also *remove* the quotes. Yes... dumb is right. :P – Lars Kemmann Sep 16 '16 at 02:48
@LarsKemmann - quotes are for powershell, no quotes for command shell - see codingoutlouds answer below – CJM May 19 '17 at 11:24
2

@Alexandru you do not have to put appid before certhash - it is likely that doing that inadvertently fixed a different issue for you. – CJM May 19 '17 at 11:25
You have to REMOVE all quotes around appid, otherwise you get "The parameter is incorrect". – AlexPi Dec 22 '20 at 04:48

score 44 · Answer 2 · answered Oct 07 '13 at 21:53

44

Another possible cause for this problem is hidden characters being copied from the Certificate Manager page. If you copy the thumbprint from the details window in Certificates, check for a hidden character at the start (use your arrow keys!). This was the cause for me of the "The Parameter is Incorrect" error message.

answered Oct 07 '13 at 21:53

Richard

27,531
8
67
116

You're awesome. There is a weird little tick when there is a special character. I noticed it at first but didn't think anything of it. Just removed that special character and SUCCESS. Thanks! – dst3p Jan 25 '17 at 05:15

score 34 · Answer 3 · edited Feb 22 '19 at 14:32

34

The PowerShell command line and PowerShell scripts in ps1 files will think curley-braces {...} are PowerShell directives. So quote them. Otherwise, as you have seen, PowerShell will be confused.

So rather than this (which you found fails):

netsh http add sslcert ipport:10.141.146.227:7001 certhash=5d48e604007b867ae8a69260a4ad318d2c05d8ff appid= {EDE3C891-306C-40fe-BAD4-895B236A1CC8}

Do this (note the single quotes):

netsh http add sslcert ipport:10.141.146.227:7001 certhash=5d48e604007b867ae8a69260a4ad318d2c05d8ff appid= '{EDE3C891-306C-40fe-BAD4-895B236A1CC8}'

Here is some information about PowerShell syntax with curley braces:

http://danv74.wordpress.com/2012/07/12/powershell-and-the-hidden-art-of-curly-braces-and-other-braces/

edited Feb 22 '19 at 14:32

RobIII

7,384
1
33
79

answered Mar 08 '14 at 17:22

codingoutloud

2,006
19
21

1

This. You get the same error in cmd if you don't include the curly braces on the guid, or if you don't quote them in powershell. – Mar 28 '17 at 14:12
definitely the single quotes in powershell! – reckface Jan 23 '19 at 09:08

cmptrgeekken · Answer 4 · 2009-05-05T21:30:17.403

14

Looking at the syntax for the netsh command, I saw this example:

add sslcert ipport=1.1.1.1:443 certhash=0102030405060708090A0B0C0D0E0F1011121314 appid={00112233-4455-6677-8899-AABBCCDDEEFF}

By the looks of it, your problem is that you're doing

ipport:10.141.146.227:7001
      ^

as opposed to

ipport=10.141.146.227:7001
      ^

edited May 05 '09 at 21:30

answered May 05 '09 at 21:12

cmptrgeekken

7,454
3
27
33

score 11 · Answer 5 · answered Sep 16 '16 at 07:59

Copying the certificate thumbprint from the Certificate\Details\Thumbprint would prepend the thumbprint value with the the bytes '3f38' which, when converted to ANSI were shown as a '?'. This hidden value caused the issue for me.

I pasted the value into notepad++, chose 'Encoding' > 'Convert to ANSI', then I manually removed the prepended '?' characters. I would then have a clean thumbprint value to use.

score 10 · Answer 6 · answered Oct 04 '15 at 05:14

10

Copy the command into notepad
Save it as ANSI
Close and reopen the file
Remove bogus ? characters
Copy from notepad to the command prompt and run the command

answered Oct 04 '15 at 05:14

tcb

3,612
3
26
48

score 10 · Answer 7 · answered Jul 13 '17 at 17:17

I faced this problem several times and every time it had a different cause, so I decided to write the causes and exact command that worked for me.

Here are some causes:

1- Copy and pasting certificate thumbprint from windows dialog adds a hidden character to your hash. It is not visible in text editors but you need to remove the character to make it work.

2- SSL thumbprint should be available in Personal -> Certificates to work with localhost.

3-It should be 'ipport=' not 'ipport:'

4- SSL certificate should have a private key. If you are using certificate management console, make sure that it has a little key icon on the certificate view.

5- GUID should be defined in full format: {a10b0420-a21f-45de-a1f8-818b5001145a}, and it should have one quote in powershell: '{a10b0420-a21f-45de-a1f8-818b5001145a}' Thus, PowerShell format is different from command line.

6- SSL Cert should have complete characters with all padding '0's and without any space. You may copy thumbprint (be careful to remove special hidden character) and remove spaces, or use 'netsh http show sslcert' to get the value if the certificate is already registered for another address.

What worked for me:

Here is the exact command that worked for me in powershell:

netsh http add sslcert ipport=0.0.0.0:20001 certhash=5304c034548b27c72b5e9c14f0c7bdd13e52d760 appid='{a10b0420-a21f-45de-a1f8-818b5001145a}'

And here is the command line statement:

netsh
http add sslcert ipport=0.0.0.0:20001 certhash=5304c034548b27c72b5e9c14f0c7bdd13e52d760 appid={a10b0420-a21f-45de-a1f8-818b5001145a}

More commands to help you avoid related problems:

Use the following command to see current registered certificate. You may find and reuse certhash or your appid from there:

netsh http show sslcert

If the certificate is already registered with similar ip and port, you need to remove it. I found it cause problem with localhost, 127.0.0.1 and 0.0.0.0. You need to have only 0.0.0.0 registered in your testing environment. Use the following command to remove potential corrupted certificates:

netsh http delete sslcert ipport=0.0.0.0:20001

score 5 · Answer 8 · answered Jul 16 '09 at 15:51

5

I was getting this error as well when I was just getting started with http.sys. After I ran:

netsh http add iplisten ipaddress=0.0.0.0

then the netsh http add sslcert commands started behaving properly.

answered Jul 16 '09 at 15:51

Tim Danner

620
7
19

This was my issue. – x0n Apr 06 '17 at 21:35
Seems like this helped me too, even though i've tried a lot of different changes lately, so not sure... – Alexander Jun 01 '18 at 09:47

score 5 · Answer 9 · edited Jun 20 '20 at 09:12

In my case the problem is that I following the microsoft inscructions I copied the thumbprint from the SSL window. the thing is that doing so copies non-printable character at the beginning of the hash.

Try to paste the thumbprint into notepad and then press home and pres delete twice (until the first char from the thumbprint is deleted) and the re-add the char. You can see the char if you copy the thumbprint and paste it into cmd:

thumbprint with "?"

score 3 · Answer 10 · answered May 12 '15 at 21:26

3

Using the Serial number instead of the Thumbprint for the certhash parameter will cause this error because of the difference in the amount of characters. Padding with 0s will change the error to SSL Certificate add failed, Error: 1312

answered May 12 '15 at 21:26

Daniel N

379
6
16

score 3 · Answer 11 · answered Apr 24 '11 at 18:54

I ran across this question while looking for a solution to the problem. I finally found one that worked for me.

My certhash parameter wasn't fully 20 bytes long. I had to pad it with zeroes in front to get it to work.

So, instead of

certhash=112233445566778899aabbccddeeff00, I had to do this:

certhash=00000000112233445566778899aabbccddeeff00.

Hope this helps.

score 2 · Answer 12 · answered Nov 05 '14 at 21:05

2

Sir, you have ipport: rather than ipport= which is easy to do since you follow that with ip:port

Also, watch out for the { versus < or (, that has also gotten me in the past.

answered Nov 05 '14 at 21:05

GMLewisII

326
1
7

score 2 · Answer 13 · answered Jun 03 '16 at 13:14

2

Watch out, if you have a DNS Name as a Binding use hostnameport instead of ipport

netsh http delete sslcert hostnameport=domainame.com:443

I had to delete ADFS Proxy Bindings for Office 365 Single-Sign On.

answered Jun 03 '16 at 13:14

joelschmid

778
1
14
30

score 1 · Answer 14 · edited Jul 05 '17 at 18:37

1

This will work from the PowerShell commadline:

$AppId = [Guid]::NewGuid().Guid
$Hash = "209966E2BEDA57E3DB74FD4B1E7266F43EB7B56D"

netsh http add sslcert hostname=localhost:8088 certhash=$Hash appid=`{$AppId`} certstorename my

The important details are to escape each { } with a backtick (`) and not to omit certstorename. Otherwise netsh raises an error 87.

The variables are just for sake of convenience.

edited Jul 05 '17 at 18:37

Vinney Kelly

4,777
1
22
30

answered Jun 18 '17 at 14:12

PeterXX

419
3
12

Thanks for this! In my testing, `ipport=` would work quite happily, but `hostnameport=` would not. Adding `certstore=my` fixed the `hostnameport=` case. Strange! :-) – Nicholas Blumhardt Jun 22 '17 at 02:39
Do you mean `$AppId` intead of `$Guid`? – Michael Blake Jun 23 '17 at 09:10

score 1 · Answer 15 · answered May 05 '09 at 20:31

there were a few things i did that i thought made it work after getting the same "The parameter is incorrect." Error.

1) restarted machine and did it again. it worked the first time. 2) made sure i was in c:\ and put the command again after restarting didn't work

i couldn't explain why but i think that maybe both times, there was something else wrong. because the third time this happened to me,

3) i went through the thumbprint of my CA (not the issued server cert) and copied it again from the MMC and it worked.

after this happened, i deleted it again (netsh http delete sslcert ipport=0.0.0.0:) and repeated the process using the thumbprint of the server certificate. The darned thing worked again.

I dunno, just try going through the same thing I did. maybe one of these would work. In the end, i suspect that I entered a bogus space or character in the certhash.

Martin Clemens Bloch · Answer 16 · 2013-09-20T09:45:50.187

0

The "-"s are NOT irrelevant. If your guid doesnt look exactly like this you will get the incorrect parameter error: {EDE3C891-306C-40fe-BAD4-895B236A1CC8} vs. EDE3C891306C40feBAD4895B236A1CC8 -> WRONG {EDE3C891306C40feBAD4895B236A1CC8} -> WRONG

Also Im using the guid for the appid of the IIS, not a random one.

edited Sep 20 '13 at 09:45

answered Sep 20 '13 at 09:28

Martin Clemens Bloch

941
1
11
28

score 0 · Answer 17 · answered Jul 05 '17 at 20:54

I must have ended up mangling the relationship between VS and IIS Express by deleting the localhost certificate. I was really stuck. The app wouldn't start and nothing I could do seemed to correct this disconnect (which is want brought me to this thread to begin with).

I was finally able to get over the issue by changing the assigned port on the non-SSL URL (launchSettings.json in .NET Core apps) and disabling the Enable SSL checkbox in the project settings and taking a fresh start. I was then able to add my newly created cert with this command: netsh http add sslcert ipport=0.0.0.0:44392 appid={214124cd-d05b-4309-9af9-9caa44b2b74b} certhash=A0ADC1A1002F288CCFA96261F9F352D28C675A90.

Also, note that the appid variable is not a reflection of your VS project AppID (or at least it doesn't have to be). It's just an arbitrary GUID, according to Scott Hanselmann:

The AppId doesn't really matter, its just a GUID. This tells HTTP.SYS that we're using that certificate.

This was not obvious to me and made dealing with the parameter is incorrect error that much more obscure.

If you're experiencing similar issues, good luck. I believe in you. Ping me if you're feeling lost and alone. Maybe I can remember something by then! :D

score 0 · Answer 18 · answered Nov 16 '17 at 09:36

It could be useful to add my resolution in this thread :

I was trying to add an ippport with the hostnameport parameter so I got this parameter error.

netsh http add sslcert hostnameport="10.0.0.120:443"

Instead of :

netsh http add sslcert ipport="10.0.0.120:443"

Cya !

score 0 · Answer 19 · answered Apr 08 '21 at 14:07

I had hidden issue that only showed in powershell, not on command prompt.

I had copied thumbprint from certificate and removed all spaces in notepad++, but it still had a hidden character in front

looked like this .. certhash=dca41243... was actually .. certhash="special char"dca41243...

"The parameter is incorrect." error using netsh http add sslcert

19 Answers19

Linked