Is netsh http add urlacl still required for HTTPS port binding with the integrated Kestrel web server

[forbzie22_0253]

Hi,

Using Proget 2026 with Postgres and Kestrel.

The HTTPS Support docs say that binding the integrated web server to a port below 1024 requires a URL reservation
https://docs.inedo.com/docs/installation/windows/web/https-support#https-binding-to-a-port-recommended

Example:
netsh http add urlacl url=https://*:443/ user="NETWORK SERVICE"

My understanding is that URL reservations (urlacl) only apply to HTTP.sys listeners (HttpListener/IIS).

Since the integrated web server now runs on Kestrel and not IIS, the reservation isn't needed.
Is that correct, and is the urlacl step a leftover from the earlier HttpListener/IIS-based server?

[rhessinger]

Hi @forbzie22_0253,

Unfortunately, this is still required. By default on Windows, HTTP.sys reserves all ports below port 1024. The netsh http add urlacl url=https://*:443/ user="NETWORK SERVICE" tells HTTP.sys that NETWORK SERVICE can register port 443 and listen to all traffic on it bypassing HTTP.sys.

If you specified a domain, https://my-domain.com:443 instead of https:://*:443, then HTTP.sys will handle all traffic but will allow NETWORK SERVICE to subscribe at that domain. HTTP.sys will still handle all traffic though. That will then cause the integrated web server (IWS) to use HTTP.sys instead of Kestrel, which is why we recommend the port binding method. This is all outside of IIS. That reason is also we added documentation on how to Use IIS as a reverse proxy.

Hope this helps!

Thanks,
Rich