Courseiva
AutomationGlobal Config

ip http secure-server

Enables the HTTPS server on a Cisco IOS device to allow secure web-based management and API access using SSL/TLS.

Definition: ip http secure-server is a Cisco IOS global config command. Enables the HTTPS server on a Cisco IOS device to allow secure web-based management and API access using SSL/TLS.

Overview

The `ip http secure-server` command enables the HTTPS server on a Cisco IOS device, allowing secure web-based management and API access using SSL/TLS. This command is critical for modern network administration where secure remote access is mandatory. It activates the device's built-in HTTP server with encryption, ensuring that management traffic—such as configuration changes, monitoring, and REST API calls—is protected from eavesdropping and tampering.

The underlying concept is the use of SSL/TLS to encrypt HTTP sessions, similar to how HTTPS secures web traffic. Network engineers reach for this command when they need to provide a graphical interface (WebUI) for less experienced staff, enable RESTCONF or NETCONF over HTTPS for automation, or comply with security policies that forbid unencrypted HTTP. Alternatives include using SSH for CLI access or SNMPv3 for monitoring, but HTTPS offers a user-friendly web interface and is required for certain automation protocols.

In the broader workflow, enabling HTTPS is often part of initial device hardening alongside setting a hostname, domain name, and generating RSA keys for encryption. Important IOS behaviors: the command requires prior generation of RSA keys via `crypto key generate rsa`; the HTTPS server runs on TCP port 443 by default; privilege level 15 is required to enable it; and the configuration is saved in running-config. Without proper certificate configuration, the device uses a self-signed certificate, which may trigger browser warnings.

The command is available from global configuration mode and is supported in IOS 12.0 and later, with enhancements in newer versions for TLS 1.2 support. It is a foundational command for secure device management and automation readiness.

Syntax·Global Config
ip http secure-server

When to Use This Command

  • Securing the web GUI (e.g., Cisco Configuration Professional) with HTTPS instead of HTTP.
  • Enabling RESTCONF or NETCONF over HTTPS for programmatic network automation.
  • Providing encrypted remote management access to network administrators via a web browser.
  • Complying with security policies that require encrypted management traffic.

Command Examples

Enable HTTPS server with default settings

ip http secure-server
Router(config)# ip http secure-server
Router(config)# 
%HTTPS: Starting HTTPS server on port 443
Router(config)#

The command enables the HTTPS server on the default port 443. The output confirms the server has started.

Verify HTTPS server status

show ip http server status
HTTP server status: Enabled
HTTP server port: 80
HTTPS server status: Enabled
HTTPS server port: 443
HTTP authentication method: local
HTTP timeout: 180 seconds
HTTP maximum number of connections: 5
HTTP secure server cipher suite: 3des-ede-cbc-sha
HTTP secure server TLS version: 1.2

The output shows both HTTP and HTTPS servers are enabled. HTTPS uses port 443, TLS 1.2, and 3DES encryption. The authentication method is local.

Understanding the Output

The command itself produces minimal output, typically just a confirmation message. To verify, use 'show ip http server status'. Key fields: 'HTTPS server status' should be 'Enabled'; 'HTTPS server port' is usually 443; 'HTTP authentication method' shows how users are authenticated (local, AAA, etc.); 'HTTP secure server TLS version' indicates the TLS version (should be 1.2 or higher for security).

If the server fails to start, check for certificate issues or port conflicts.

Configuration Scenarios

Enable HTTPS Server for Web-Based Management

A network administrator needs to provide secure web access to a Cisco router for a junior team member who prefers GUI-based configuration. The router is at 192.168.1.1 and must be accessible over the internet via HTTPS.

Topology

Internet---(Gi0/0)Router(192.168.1.1)---(Gi0/1)LAN

Steps

  1. 1.Step 1: Enter global configuration mode: Router> enable
  2. 2.Step 2: Generate RSA keys (minimum 2048 bits): Router(config)# crypto key generate rsa modulus 2048
  3. 3.Step 3: Configure a hostname and domain name (required for certificate): Router(config)# hostname BranchRouter
  4. 4.Step 4: Set the domain name: BranchRouter(config)# ip domain-name example.com
  5. 5.Step 5: Enable the HTTPS server: BranchRouter(config)# ip http secure-server
  6. 6.Step 6: (Optional) Restrict access to specific IPs using an ACL: BranchRouter(config)# ip http access-class 10
  7. 7.Step 7: (Optional) Set HTTPS port to 8443: BranchRouter(config)# ip http secure-port 8443
Configuration
! Full IOS config block
BranchRouter(config)# crypto key generate rsa modulus 2048
BranchRouter(config)# hostname BranchRouter
BranchRouter(config)# ip domain-name example.com
BranchRouter(config)# ip http secure-server
BranchRouter(config)# ip http access-class 10
BranchRouter(config)# access-list 10 permit 10.0.0.0 0.255.255.255
BranchRouter(config)# ip http secure-port 8443

Verify: Verify with: show ip http server status. Expected output includes 'HTTP secure server status: Enabled' and the port number. Also test by browsing to https://192.168.1.1:8443.

Watch out: If RSA keys are not generated first, the command will fail with 'No RSA keys configured'. Also, ensure the domain name is set; otherwise, the self-signed certificate may cause browser errors.

Enable HTTPS for RESTCONF API Access

A network engineer wants to automate configuration using RESTCONF over HTTPS. The device is a Catalyst 9300 running IOS-XE 16.12. The engineer needs to enable the HTTPS server and configure RESTCONF.

Topology

Management Station(10.0.0.10)---(Gi1/0/1)Switch(10.0.0.1)---(Gi1/0/2)Core

Steps

  1. 1.Step 1: Enter global configuration mode: Switch> enable
  2. 2.Step 2: Generate RSA keys: Switch(config)# crypto key generate rsa modulus 2048
  3. 3.Step 3: Set hostname and domain: Switch(config)# hostname CoreSwitch Switch(config)# ip domain-name company.com
  4. 4.Step 4: Enable HTTPS server: Switch(config)# ip http secure-server
  5. 5.Step 5: Enable RESTCONF: Switch(config)# restconf
  6. 6.Step 6: (Optional) Enable HTTP authentication local: Switch(config)# ip http authentication local
  7. 7.Step 7: Create a local user: Switch(config)# username admin privilege 15 secret cisco123
Configuration
! Full IOS config block
Switch(config)# crypto key generate rsa modulus 2048
Switch(config)# hostname CoreSwitch
Switch(config)# ip domain-name company.com
Switch(config)# ip http secure-server
Switch(config)# restconf
Switch(config)# ip http authentication local
Switch(config)# username admin privilege 15 secret cisco123

Verify: Verify with: show restconf status. Expected output: 'RESTCONF enabled on port 443'. Also test with curl -k https://10.0.0.1/restconf/data/Cisco-IOS-XE-native:native -u admin:cisco123

Watch out: RESTCONF requires the HTTPS server to be enabled; without it, RESTCONF will not start. Also, ensure the user has privilege 15 for full access.

Troubleshooting with This Command

When troubleshooting the `ip http secure-server` command, focus on the output of `show ip http server status`. Healthy output shows 'HTTP secure server status: Enabled' and 'HTTP secure server port: 443' (or custom port). If the status is 'Disabled', the command may not have been applied, or the configuration was removed.

Common problem indicators include 'No RSA keys configured' in the output, which means the HTTPS server cannot start. To diagnose, first check if RSA keys exist with `show crypto key mypubkey rsa`. If no keys are present, generate them with `crypto key generate rsa modulus 2048`.

Another issue is certificate errors: the device uses a self-signed certificate by default, which browsers flag as untrusted. To resolve, import a trusted certificate using `crypto pki import`. If the HTTPS server is enabled but unreachable, verify that an ACL is not blocking access with `show ip http access-class`.

Also check that the port is not used by another service using `show ip port-map`. For connectivity issues, use `telnet <device-ip> 443` from a management station to test TCP port 443 reachability. If the connection fails, check interface ACLs and firewall rules.

Correlate with `debug ip http` to see incoming requests and errors. Common symptoms: 'Connection refused' indicates the server is not listening; 'SSL handshake failed' suggests certificate or TLS version mismatch. For automation, verify RESTCONF status with `show restconf status` and ensure the HTTPS server is enabled.

If RESTCONF is not working, check that the user has proper privileges and authentication method is set (e.g., `ip http authentication local`). Step-by-step diagnostic flow: 1) Verify HTTPS server status. 2) Check RSA keys. 3) Test port connectivity. 4) Review ACLs. 5) Check certificate validity. 6) Enable debug if needed. Always correlate with system logs using `show logging | include HTTP`.

CCNA Exam Tips

1.

CCNA exam may ask which command enables secure web access; remember 'ip http secure-server' in global config.

2.

Know that 'ip http secure-server' requires a trustpoint certificate; if none is configured, the router generates a self-signed certificate.

3.

The exam might test that HTTPS uses port 443 by default, and you can change it with 'ip http secure-port'.

4.

Be aware that 'ip http server' must be enabled first for HTTPS to work, though HTTPS can be enabled independently.

Common Mistakes

Forgetting to enable 'ip http server' before 'ip http secure-server' — HTTPS may fail to start.

Not configuring a trustpoint or certificate, causing the router to use a self-signed certificate that browsers may reject.

Confusing 'ip http secure-server' with 'ip http server' — the former enables HTTPS, the latter enables HTTP.

ip http secure-server vs ip http server

The ip http secure-server and ip http server commands both enable web-based management on Cisco IOS devices. They are often confused because both serve similar purposes, but the key difference lies in security: the former uses SSL/TLS encryption while the latter sends data in plaintext.

Aspectip http secure-serverip http server
SecurityEncrypted (SSL/TLS)Plaintext (HTTP)
DependenciesRequires a trustpoint with RSA key pair and certificateNone
Default Port44380
Typical UseSecure remote management, REST API accessInternal or lab management, non-sensitive access
Configuration RequirementMust also configure ip http secure-trustpoint or certificateJust enable with ip http server

Use ip http secure-server when managing devices over untrusted networks or enabling APIs that require encryption.

Use ip http server only in controlled environments or for initial setup when certificates are not yet configured.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches), the command syntax is identical: `ip http secure-server`. However, IOS-XE 16.x and later support TLS 1.2 by default, while older IOS 15.x may only support TLS 1.0. To enforce TLS version, use `ip http secure-server tls-version 1.2`.

In NX-OS (e.g., Nexus 9000), the equivalent command is `feature http-server` followed by `ip http secure-server` (note: NX-OS uses 'feature' to enable services). The NX-OS syntax also includes `ip http port` for custom ports. For ASA firewalls, the command is `http server enable` and `http 0.0.0.0 0.0.0.0 inside` to allow HTTPS access; ASA uses a different configuration model.

In IOS-XR (e.g., ASR 9000), the command is `http-server secure` under the appropriate configuration mode (e.g., `http-server`). Note that IOS-XR does not use `ip http secure-server`; instead, it uses `http-server secure` and requires SSL configuration. Behavior differences: In IOS 12.x, the command was introduced but lacked TLS 1.2 support; in 15.x, TLS 1.0/1.1 were common; in 16.x, TLS 1.2 is default.

Always check the specific IOS version documentation for TLS support. For automation, IOS-XE and IOS 15.x+ support RESTCONF, while NX-OS supports NX-API over HTTPS. The command is not available in IOS-XR in the same form; use `http-server secure` instead.

Related Commands

crypto key generate rsa

Generates RSA key pairs used to enable SSH on Cisco IOS devices. The modulus size determines key strength — minimum 768 bits for SSH version 1, 1024 bits recommended for SSH version 2.

ip http server

Enables the HTTP server on a Cisco IOS device, allowing web-based management and access to the device's web interface for configuration and monitoring.

show ip http server status

Displays the operational status and configuration of the HTTP server (web server) on the Cisco IOS device, used to verify if the web-based GUI or REST API is enabled and accessible.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions