How to Run a Simple HTTPS Server on Windows

The short answer

To run a simple HTTPS server on Windows, you need three things: a certificate and private key, a small web server that can use them, and a browser that trusts the certificate. One practical setup is mkcert to create a locally trusted certificate, plus a few lines of Python or a single Node.js command to serve your files over HTTPS.

First check whether you need HTTPS at all. Browsers only allow camera and microphone access in a secure context, meaning a secure page. A page served over HTTPS counts. So does a page opened through localhost on the same computer, even over plain HTTP. If you are only testing a camera page in a browser on the same Windows PC that runs the server, an ordinary local HTTP server opened through localhost is usually enough. You need HTTPS when another device opens the page, such as a phone or a second laptop on your network using the PC's IP address.

Why camera pages need a secure context

Web pages request the camera and microphone through a browser feature called getUserMedia. Browsers expose it only on secure pages. On an insecure page, the request fails, or the object that provides it (navigator.mediaDevices) is missing entirely. This is why a camera test page can work on your own PC and fail when you open it from a phone by IP address.

HTTPS only makes the page eligible to ask for the camera. The browser still shows its own permission prompt, and the operating system's privacy settings can still block access. Once access is granted, getting a working video picture, and then good call quality, are separate checks.

Step 1: Create a certificate the browser will trust

A certificate is a file that proves the server's identity to the browser, and the private key is the secret file that goes with it. You can create a certificate yourself, but browsers will warn about it unless they trust whoever issued it. mkcert is a free command-line tool that solves this for local testing. It creates a private certificate authority on your PC, installs it into the Windows trust store, and issues certificates signed by it.

• Install mkcert, for example through a Windows package manager such as Chocolatey or Scoop, or by downloading the Windows release from the project's official page.
• Open PowerShell or Command Prompt in the folder you want to serve.
• Run the commands below. Replace 192.168.1.50 with your PC's own local IP address if other devices will connect.

mkcert -install
mkcert -cert-file cert.pem -key-file key.pem localhost 127.0.0.1 192.168.1.50

To find your local IP address, run ipconfig and look for the IPv4 Address line under your active network adapter. The certificate must list every name or address you will type into the browser. If your IP changes, generate a new certificate.

Keep the mkcert root key private. That file, named rootCA-key.pem, sits in the folder shown by mkcert -CAROOT. Anyone who has it could create certificates your PC would trust. Never share it or copy it into a project folder.

Alternative: a self-signed certificate with OpenSSL

If you cannot install mkcert, you can create a self-signed certificate with OpenSSL. Windows does not include OpenSSL, but Git for Windows ships a copy you can run from Git Bash. Browsers will show a warning page for this certificate. For your own testing, you can usually click past the warning, and the page should then count as secure.

openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365 -subj "/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1,IP:192.168.1.50"

Step 2: Start the server

Put cert.pem and key.pem in the folder you want to serve, along with your HTML page. Then use whichever option matches what you already have installed.

Option A: Python

Python's built-in web server, http.server, serves files from a folder. The short script below wraps it in HTTPS using Python's standard ssl module. Save it as serve_https.py in the folder and run python serve_https.py.

import http.server
import ssl

server = http.server.HTTPServer(("0.0.0.0", 8443), http.server.SimpleHTTPRequestHandler)
context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
context.load_cert_chain(certfile="cert.pem", keyfile="key.pem")
server.socket = context.wrap_socket(server.socket, server_side=True)
print("Serving this folder over HTTPS on port 8443")
server.serve_forever()

The address 0.0.0.0 tells the server to accept connections from other devices on your network. To restrict it to this PC only, change it to 127.0.0.1. Press Ctrl+C to stop the server.

Option B: Node.js

If Node.js is installed, the http-server package can serve a folder over HTTPS without a script. The -S flag turns on HTTPS, and -C and -K point to the certificate and key.

npx http-server -S -C cert.pem -K key.pem -p 8443

Step 3: Allow it through Windows Firewall if needed

The first time Python or Node.js accepts network connections, Windows Defender Firewall may ask whether to allow it. Allow it on private networks only, such as your home network. Do not allow it on public networks. If you dismissed the prompt and other devices cannot connect, change the setting in the firewall's allowed apps list. Connections from the same PC through localhost are not affected.

Step 4: Open the page and verify it is secure

In a browser on the same PC, enter https, then localhost, then port 8443. From another device, use your PC's IP address in place of localhost. Make sure the address starts with https and that you include the port number.

• No certificate warning appears (with mkcert, on the PC where you ran mkcert -install).
• The browser's site information icon reports a secure connection.
• Typing window.isSecureContext into the browser's developer console returns true.
• Typing navigator.mediaDevices into the console returns an object rather than undefined.
• Your camera or microphone page shows the browser's permission prompt when it requests access.

After you allow access, check separately that a live image or audio level actually appears. If permission is granted but there is no picture, the cause is usually something other than HTTPS. Common causes include another app holding the camera, a privacy shutter, or the wrong device selected in the page or browser settings.

Common problems

Symptom | Likely cause | What to try

Certificate warning on a phone or second computer | That device does not trust the mkcert root authority | Install the mkcert root certificate on that device, or accept the warning for testing

Certificate warning when using the IP address | The IP is missing from the certificate, or has changed | Regenerate the certificate including the current IP

Other devices cannot connect at all | Firewall blocking, server bound to 127.0.0.1, or devices on different networks | Allow the app on private networks, bind to 0.0.0.0, confirm both devices share the same network

navigator.mediaDevices is undefined | The page is not a secure context | Make sure the address uses https, not http

Prompt never appears or access is blocked | Earlier denial saved in the browser, or Windows camera privacy settings | Reset the site's camera permission in the browser and check Windows camera and microphone privacy settings

Limits of this setup

This setup is for local testing on a network you trust. It is not suitable for hosting a site on the internet. mkcert certificates are trusted only on devices where you install its root certificate. Exact menu names, prompts and command options can differ between versions of Windows, browsers, Python and Node.js, and this guide does not cover version-specific differences. If a command fails, check the help output of the tool you have installed, for example mkcert -help or npx http-server --help.