AVEVA™ P&ID

Enable the HTTPS Protocol for the AVEVA P&ID Report Service

Save PDF

Enable the HTTPS Protocol for the AVEVA P&ID Report Service

Save PDF

Last UpdatedMay 23, 2025
6 minute read

Engineering

As of AVEVA P&ID 12.4, security for the AVEVA P&ID Report Service has been enhanced with the option of using the HTTPS protocol.

The additional setup required before this option can be used, and the procedure for enabling the HTTPS option are described in this topic.

Configuration

To facilitate configuration, a PowerShell script (PowerShellScriptToCreateSSLCerForPID.ps1) is provided in the installation folder of AVEVA P&ID Report Service 12.4.
Open Windows PowerShell ISE as an administrator:
Run PowerShellScriptToCreateSSLCerForPID.ps1.

Note: You should not execute the PowerShell script if you are upgrading from AVEVA P&ID 12.4, because the SSL Certificate creation and port number binding will already have been completed.

Note: The PowerShell script creates a self-signed certificate and binds it to the port number.

Note: If you are using a valid certificate from certificate authority then make sure to create the certificate for the hostname and check if it is a trusted root.

Steps to Verify the Certificate is a Trusted Root

Select Run from the Start menu, and then enter certlm.msc.
The Certificate Manager tool for the local device appears.
Navigate to Certificates (Local Computer) > Personal > Certificates and locate the certificate you have created for the current host.
Navigate to Trusted Root Authorities > Certificates and locate the same certificate.
If not found, follow the below steps to import the certificate from personal certificates.

Export the Certificate from Personal Certificates

Navigate to Certificates (Local Computer) > Personal > Certificates and locate the certificate you have created for the current host.
Select the certificate, right-click and select All Tasks, then Export. The Certificate Export Wizard window appears:
Click Next.
Continue to click Next, accepting the default settings:
On the next page of the wizard, enter a password:
Continue to click Next, until the final page is displayed, and click Finish.

Import the Certificate to the Trusted Root

Right-click on the Trusted Root Certification Authorities tab in the Certificate Manager tool and select All Tasks, then Import. The Certificate Import Wizard window appears.
Click Next until the File to Import page is displayed.
Click Browse... and select the certificate file you saved earlier. Click Next.
Enter the password you entered in the export wizard. Click Next and Finish.
A security warning is displayed. Click Yes.

Generate the Certificates "Manually"

If the PowerShell script failed to generate SSL certificates or binding to the port number is failed, then follow the instructions to generate the certificates:

Step 1. Create new SSL certificate.
Step 2. Bind the generated SSL certificate to the required port number.
Step 3. Copy the SSL certificate to the trusted root (as described previously).

Step 1. Create New SSL Certificate.

Open the Command Prompt as an Administrator:

Select Run from the Start menu, and enter cmd.
Right-click Command Prompt.
Select Run as administrator.

Copy the following command and paste it into the command prompt window:

New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -DnsName "localhost"

Replace "localhost" with hostname.

Step 2. Bind the Generated SSL Certificate to the Required Port Number

Copy the following command and paste it into the command prompt window:

netsh http add sslcert ipport=0.0.0.0:8082 certhash=<certificate_thumbprint> appid={<your_app_id>}

Replace <certificate_thumbprint> with the actual thumbprint. If you do not know the thumbprint, follow the "Finding the Certificate Thumbprint" instructions later in this topic.

Replace <your_app_id> with your application GUID (can be any valid GUID).

Run the following command in PowerShell for the new GUID:

[guid]::NewGuid()

Finding the Certificate Thumbprint

Select Run from the Start menu, and then enter certlm.msc.
The Certificate Manager tool for the local device appears.
Navigate to Certificates (Local Computer) > Personal > Certificates.
Double-click on the certificate.
Go to the Details tab.
Find the Thumbprint field and copy its value.

If the Certificate Fails to Bind with the Port

If the certificate fails to bind to the port:

Check whether there is already a certificate bound to that port by using the following command:

netsh http show sslcert
Look for port number 8082 in the results of the command. If the results include 8082, delete the binding using the following command:

netsh http delete sslcert ipport=0.0.0.0:8082
Run Step 2 again. The port should now bid successfully.