Custom Domain & HTTPS Setup

Windows EXE deployment · IIS reverse proxy

Use your company HTTPS address after installing the Windows EXE. No EXE rebuild is required.

Download PDF GuideVersion 1.0 · 31 October 2026 · ITCloudSoft

1. Understand the setup

Users open the company HTTPS address. DNS resolves the name to your server. IIS receives the encrypted connection on port 443 and forwards it to the Asset Management application over HTTP on 127.0.0.1:5000 on the same computer.

Example values used throughout this guide:

Replace these examples with your own hostname and server IP. The example domain is a placeholder; it is not provided with the software. Setting PUBLIC_BASE_URL alone does not create DNS records, install a certificate, or configure IIS.

2. Before you begin

  • Install the Asset Management System EXE and confirm the existing login works.
  • Sign in to the server with Windows administrator access.
  • Use a stable server IP, through a static address or DHCP reservation.
  • Obtain permission to add a DNS record under a company-controlled domain.
  • Obtain an HTTPS certificate whose Subject Alternative Name includes your chosen hostname. The certificate must have its private key and be trusted by client computers.
  • Install IIS, its management tools, WebSocket Protocol, Microsoft URL Rewrite, and Application Request Routing (ARR).
  • Check that port 443 is available and that the change will not conflict with existing IIS sites.
  • Schedule a brief interruption for the application service restart.

Back up the current application .env file and the existing IIS configuration before changing them. Keep database, licence and installation-identity settings unchanged. Do not publish the .env file, passwords, certificate private keys or database connection strings on your website.

3. Configure company DNS

For office-network access, add the record on the internal DNS server used by employee computers.

In Windows DNS Manager:

  1. Expand your DNS server, then Forward Lookup Zones.
  2. Open the appropriate company zone, such as yourcompany.com.
  3. Select New Host (A or AAAA).
  4. Enter assets as the host name and 192.168.1.12 as the IP address.
  5. Save the record. Confirm client computers use DNS that can resolve this zone.

On a client computer, verify the result:

powershell
Resolve-DnsName assets.yourcompany.com

For this office-only example, the returned A record should be 192.168.1.12. A hosts-file entry affects only the individual computer and is not a replacement for company DNS.

Internet access requires a separate network design: public DNS must resolve to a reachable public address or gateway, not the private 192.168.1.12 address. Configure firewall/NAT or a managed gateway and a publicly trusted certificate. A VPN can provide remote access to an internal-only deployment. Do not expose port 5000 directly.

4. Configure the installed application

Open Notepad as Administrator. Use File > Open and select All Files to open:

text
C:\ProgramData\ITCloudSoft\AssetManagementSystem\.env

Older installations may use this legacy location instead:

text
C:\ProgramData\ITCloudSoft\Asset Management System\.env

The launcher uses the current path when it exists, otherwise the legacy path. Edit the active file; do not create a second file accidentally. Back it up securely first. Update these settings without removing unrelated existing values:

env
PUBLIC_BASE_URL=https://assets.yourcompany.com
BASE_URL=https://assets.yourcompany.com
ASSET_HTTPS_MODE=iis
ASSET_LOCAL_HTTPS=false
FLASK_HOST=127.0.0.1
FLASK_PORT=5000
TRUST_PROXY=true
TRUST_PROXY_X_FOR=1
TRUST_PROXY_X_PROTO=1
TRUST_PROXY_X_HOST=1
TRUST_PROXY_X_PORT=0
FORCE_HTTPS=true
SESSION_COOKIE_SECURE=true

These values assume IIS and the application run on the same Windows computer, with one trusted reverse proxy. IIS terminates HTTPS; the application listens only on loopback. Keep FORCE_HTTPS and secure session cookies enabled for the public HTTPS address. If your deployment has a different proxy topology, its administrator must adjust the trusted proxy settings.

Save the file as .env, not .env.txt. Existing Windows service environment variables may override file values; check them if the application continues to use older settings.

5. Configure IIS and the certificate

  1. Import the HTTPS certificate and private key into Certificates (Local Computer) > Personal > Certificates. Confirm the hostname and expiry date.
  2. In IIS Manager, select the server > Application Request Routing Cache > Server Proxy Settings. Enable Proxy and apply.
  3. Create a dedicated site for the Asset Management application using a dedicated physical directory for its proxy web.config. Avoid changing an unrelated website.
  4. Open the site's Bindings. Add an HTTPS binding on port 443 with your hostname and matching certificate. Use Server Name Indication when sharing port 443 with other named sites.
  5. At the IIS server level, open URL Rewrite > View Server Variables. Allow HTTP_X_FORWARDED_PROTO and HTTP_X_FORWARDED_HOST for the site's rewrite rule.
  6. Add a site-level inbound URL Rewrite rule. Match pattern (.*), action Rewrite, target http://127.0.0.1:5000/{R:1}, append the query string, and stop processing subsequent rules.
  7. In the rule's server variables, set HTTP_X_FORWARDED_PROTO to https and HTTP_X_FORWARDED_HOST to assets.yourcompany.com. Preserve the original host through ARR where your configuration supports it.
  8. Enable WebSocket Protocol for the site if remote-support features use it.
  9. Allow inbound TCP 443 from intended client networks in Windows Firewall and relevant network firewalls. The loopback backend does not need a public inbound port 5000 rule.

If you also bind HTTP port 80, redirect that binding to the HTTPS hostname. Do not serve the login page over plain HTTP. Port 80 may also be needed by your certificate-issuance process; follow your certificate administrator's requirements.

The deployment package or source distribution may include configure_iis_reverse_proxy.ps1. An administrator may use it after reviewing it and installing its prerequisites. It is not assumed to be included in every EXE installation. The script creates or replaces its named IIS site and still requires correct DNS, certificates and allowed forwarded server variables. Manual configuration above is suitable when the script is unavailable.

6. Restart and verify

After completing IIS setup, restart the application service from an elevated PowerShell window:

powershell
Restart-Service -Name AssetManagementSystem
Get-Service -Name AssetManagementSystem

Alternatively, open Windows Services and restart the installed Asset Management service. Use the actual service name if your installation was customized.

Then check from an employee computer:

powershell
Resolve-DnsName assets.yourcompany.com
Test-NetConnection assets.yourcompany.com -Port 443

Open https://assets.yourcompany.com/login and confirm:

  • The certificate is trusted and matches the hostname.
  • Login and logout work without redirect loops.
  • The dashboard, images, menus and downloads load correctly.
  • Generated links use the hostname rather than the old IP address.
  • Remote support and WebSocket-dependent functions work, if used.

If Microsoft Entra sign-in is enabled, add https://assets.yourcompany.com/auth/microsoft/callback as an approved Web redirect URI in the Entra app registration and update ASSET_ENTRA_REDIRECT_URI in the active environment configuration. Restart the service after changing it.

The old IP-address URL on port 5000 will no longer be the client entry point when the backend is bound to 127.0.0.1. Distribute the new HTTPS hostname to users.

7. Troubleshooting

Name not found: check the A record, DNS zone and client DNS server. Confirm the hostname spelling and allow for DNS caching.

Certificate warning: check the certificate hostname, trust chain, expiry, private key and IIS binding. An internal CA certificate requires trusted root deployment to client computers.

IIS 502 / Bad Gateway: confirm the Windows service is running and listening on 127.0.0.1:5000. Confirm the backend is HTTP in IIS mode; do not forward HTTP to an application still running direct HTTPS. Check ARR proxy settings.

IIS 500.50 / rewrite error: confirm URL Rewrite and ARR are installed and HTTP_X_FORWARDED_PROTO and HTTP_X_FORWARDED_HOST are allowed at the server level.

Redirect loop or failed session: confirm IIS forwards the HTTPS scheme and hostname, TRUST_PROXY is enabled for the single trusted proxy, and the browser opens the HTTPS address.

Old IP address in generated links: check PUBLIC_BASE_URL and BASE_URL in the active .env, overriding service environment settings, and restart the service.

Microsoft sign-in callback error: ensure the Entra Web redirect URI exactly matches the hostname and callback path in the application configuration.

For application diagnostics, inspect:

text
C:\ProgramData\ITCloudSoft\AssetManagementSystem\logs

For proxy failures, inspect IIS logs and Windows Event Viewer. Redact sensitive values before sharing diagnostics.

8. Rollback and ongoing maintenance

If the hostname deployment fails, restore the backed-up .env and original IIS bindings, then restart the application service. Confirm the previous access method works before directing users back to it. Do not delete runtime data or modify licence verification keys.

Renew the HTTPS certificate before it expires, keep DNS aligned with the server address, and recheck sign-in and remote-support features after proxy or certificate changes. Existing remote clients may need their server URL or trust configuration updated; validate them before retiring the old address.

Official configuration references

This guide describes the Windows EXE deployment with IIS on the same server. Azure, Vercel, container hosting and multiple-proxy deployments require their own hosting configuration.

Previous: MongoDB Setup Next: Licence Activation & Trial