Product documentation
Citrix Virtual Apps and Desktops
Service Current Release 2407 2402 LTSR 2311 2308 2305 2303 2212 2209 2206 2203 LTSR 1912 LTSR
View PDF

Enable TLS on Web Studio and Director

March 30, 2025
Contributed by: 
C

We recommend always using TLS to secure connections to Web Studio and Director by enabling HTTPS. This article explains how to configure Web Studio and Director to use a trusted certificate and ensure secure access over HTTPS.

Default behavior

When you install Web Studio, the installer creates a self-signed certificate and binds it to port 443 on the current server. You can access Web Studio and Director from a web browser over HTTPS on the local server.

However, if you try to access Web Studio or Director from another machine over HTTPS, the browser shows a security error because it doesn’t trust the certificate.

Note:

If you install Director without Web Studio, the installer doesn’t create a self-signed certificate.

Enable secure access over HTTPS

To allow access to Web Studio or Director over HTTPS from machines other than the Web Studio server, follow these steps:

  1. Create or import a trusted certificate.

  2. Bind the certificate to port 443 in IIS.

  3. (Optional) Enable HTTP Strict Transport Security (HSTS).

  4. If Web Studio isn’t configured as a proxy (client machines connect to both Web Studio and the Delivery Controllers), enable TLS on Delivery Controllers.

Note:

Using the self-signed certificate isn’t recommended because it requires manual configuration on each machine. For more information, see Use the self-signed certificate.

Create or import a trusted certificate

We recommend using a certificate from an enterprise or public certificate authority that is trusted by machines connecting to the server.

For more information, see Create a new certificate and Import existing certificate. The certificate’s common name or subject alternative name must match the FQDN that the users use to connect to Web Studio or Director. If a load balancer is deployed in front of the server, use the FQDN of the load balancer.

Bind the certificate to port 443

After creating or importing a trusted certificate, bind it to port 443 in IIS. You can do that either before or after installation. If certificate binding is already configured for port 443, the installer makes no changes.

Note:

By default, Web Studio and Director use port 443 for secure HTTPS access. You can change the port number if needed. See Change the default port number for details.

To bind the certificate to port 443, follow these steps:

  1. Log on to the server as an administrator.

  2. Open the IIS Manager, and browse to Sites > Default Web Site > Bindings.

  3. If there is an existing binding of type https then select it and click Edit…. If there is no https binding then click Add.

    Screenshot highlighting how to open site bindings

  4. Create or edit the site binding:

    1. For a new binding, set the type to https and the port to 443.

    2. Select the appropriate SSL certificate.

    3. On Windows Server 2022 or higher, optionally select Disable Legacy TLS to ensure that users can only connect using modern TLS versions.

    4. Click OK.

    Add site binding

Alternatively, you can change the certificate using PowerShell. For example the following script looks for a certificate with a given common name and binds it to all IP addresses, port 443, and disables legacy TLS versions.

$certSName = 'CN=whpdevddc0.bvttree.local'  # The subject name of the certificate
$certificate = Get-ChildItem -Path Cert:\LocalMachine\My\ | ? {$_.Subject -eq $certSName}
netsh http add sslcert ipport=0.0.0.0:443 certhash=$($certificate.Thumbprint) certstorename=My appid="{91fe7386-e0c2-471b-a252-1e0a805febac}" disablelegacytls=enable

Note that appid is an arbitrary GUID that can be used to identify which application added the certificate.

Use the self-signed certificate

You can use the existing self-signed certificate, but it’s not recommended because it requires manually configuring each machine that accesses the server.

To install the self-signed certificate on machines that need to connect to Web Studio:

  1. Export the existing self-signed certificate from the Web Studio and Delivery Controller servers.
  2. Import the certificate into the Trusted Root Certificate store of machines that must access the server.

(Optional) Enable HTTP Strict Transport Security (HSTS)

HTTP Strict Transport Security (HSTS) tells web browsers to only use HTTPS when accessing the site. If a user tries to access the URL using HTTP, the browser automatically switches to HTTPS. This setting ensures secure connection validation on both the client and server sides. The browser maintains this validation for the configured period.

On Windows Server 2019 and later, you can configure HSTS in IIS:

  1. Open Internet Information Services (IIS) Manager.
  2. Select Default Web Site (or the appropriate website).
  3. In the Actions pane on the right side, select HSTS….
  4. Select Enable and enter a max age, for example 31536000 for one year.
  5. Select Redirect Http to Https.

    Note:

    Web Studio automatically configures a URL Rewrite rule to redirect HTTP to HTTPS when accessing the Studio website. However, this option also applies to Director and any other applications on the IIS site.

  6. Click OK.

    Screenshot of HSTS setting

(Optional) Change the default port number

By default, Web Studio and Director use port 443 for secure HTTPS access. To change this port number, follow these steps to create a site binding for the desired port on Default Web Site.

Steps:

  1. On the server hosting Web Studio, open Internet Information Services (IIS) Manager.

  2. In the Connections pane, expand the server node and select Default Web Site under Sites.

  3. In the Actions pane on the right, click Bindings.

    Set new port

  4. In the Site Bindings window, click Add.

  5. In the Add Site Binding window, set the following for the new binding:

    1. Type: Select https.
    2. IP address: Select the appropriate IP address, or leave as All Unassigned if applicable.
    3. Port: Enter the desired port number (for example, 444).
    4. SSL certificate: Select the appropriate SSL certificate for secure communication.

    Note:

    If the Delivery Controller and Web Studio are installed on separate machines, and the server doesn’t have other services or websites deployed, you can remove port 443. Otherwise, keep this port to avoid communication issues with the Orchestration service and other FMA services.

  6. Click OK to save the binding, and then close the Site Bindings window.

  7. In IIS Manager, click the server node, then in the Actions pane, click Restart to apply the new binding.

(Optional) Disable HTTPS redirection

When you install Web Studio, by default, any HTTP access is auto-redirected to HTTPS. It is possible to disable this redirection to allow HTTP access. This approach is recommended only if you have taken other measures to block HTTP access. In the case you have a TLS terminating load balance in front of Web Studio, it is still recommended to use HTTPS between your load balancer and Web Studio.

  1. Log on to the Web Studio server.
  2. Open Internet Information Services (IIS) Manager, and go to Server_name > Sites > Default Web Site > URL Rewrite.

  3. Disable Inbound Rules for Redirection to https, as shown in the following screenshot.

    Disable HTTPS redirection

If you have enabled HSTS in IIS then you must also clear Redirect Http to Https.

Enable TLS on Web Studio and Director
March 30, 2025
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999-2025 Cloud Software Group, Inc. All rights reserved.