Using HTTPS for communication between the HTTP server and Business Tier

Jennifer Eggerton

Oct 06, 2026

1178

Purpose	Configure encrypted HTTPS communication between the CAREWare 6 HTTP server and the Business Tier.
Who should do this	CAREWare system administrators and IT staff who manage the HTTP server and Business Tier.
Use this guide when you need to	Secure message exchanges between the HTTP server and Business Tier with a trusted X.509 TLS certificate.
Main warning	These steps do not configure HTTPS communication between a web browser and the CAREWare HTTP server.

Quick path
Install the TLS certificate on the Business Tier host > bind it with netsh > update res_admin_settings.txt > change CWBusinessTierProtocol to https > restart both services > test CAREWare.

Important: This procedure secures communication only between the HTTP server and Business Tier. It does not secure communication between the browser and HTTP server.

Set up the TLS certificate

Important: The certificate must match the Business Tier hostname.

Step 1. Obtain an X.509 TLS certificate. Obtain the certificate from a trusted Certificate Authority.

Step 2. Install the certificate. On the machine that hosts the Business Tier, use the Windows Certificate Manager utility, certlm, to Install the Business Tier certificate in Local Computer > Personal > Certificates.

Important: The installed certificate must have an associated private key.

Step 3. Bind the certificate. Use the netsh command to bind the X.509 TLS certificate to the IP address and port number on which the Business Tier will accept incoming messages from the HTTP server. Run this command from an administrator Command Prompt or PowerShell window. If Certificate Manager is not available from the Start Menu, open:

C:\\WINDOWS\SYSTEM32\CERTLM.MSC

Use this syntax:

Netsh http add sslcert ipport=0.0.0.0:8000 certstorename=MY certhash=<actual-thumbprint> addid=”{generated-GUID}”

Important: The Fs in the above command are placeholders, and the command should be updated based on your organization's configuration. APPID is a GUID and certhash is the cert thumbprint. Cert binding port, Business Tier port, and URL port must all match.

Specify the command values

ipport

The IP address and port number on which the Business Tier will listen. Specify an IP address, or leave the value as 0.0.0.0 to listen on all IP addresses that refer to this machine.

certstorename

Use MY for the local computer personal certificate store. Use Root if the certificate was added to the Trusted Root Certification Authorities store.

appid

Generate a random GUID to identify the CAREWare HTTP server and use it for this parameter.

certhash

This value is also known as the certificate thumbprint. In certlm, go to Personal > Certificates, and double-click the X.509 TLS certificate that you added. Select the Details tab, and scroll to the Thumbprint field to find the value.

Set up CAREWare to use HTTPS

Step 1. Locate the HTTP server configuration file. The res_admin_settings.txt file is located at the following path by default:

C:\Program Files\CAREWare HTTP Server\cwhttp\res_admin

Step 2. Update the URLs. If CAREWare currently uses unencrypted communication between the Business Tier and HTTP server, the get_doc_url field begins with http, change its value so it begins with https instead of http.

Use the HTTP Settings Tool to update the Business Tier URL and, if needed, configure the CA certificate trusted for that connection.

Step 3. Update the Business Tier protocol. Use the CW Admin utility to change the Server Settings value tagged CWBusinessTierProtocol from http to https. Keep skip_bt_cert_verify set to False.

Step 4. Restart and test. Save the settings, and restart both the Business Tier and HTTP server. Log in to CAREWare to test that HTTPS communication is working.

Netsh http show sslcert ipport=0.0.0.0.:8000 combined with successful login for verification.

How to confirm it worked

Log in to CAREWare after restarting the Business Tier and HTTP server. A successful login confirms that the HTTP server can communicate with the Business Tier using the updated HTTPS settings.

Important: These steps do not configure CAREWare to use HTTPS for communication between the browser and HTTP server.

Related References

Document	Use it for
CW Admin Utility	Use it to change the CWBusinessTierProtocol Server Settings value from http to https.

Attachments