How to Configure Windows Sandbox Local Web Server and SSL Certificates via XML in Windows 11

Web developers and security testers frequently need an untrusted, disposable environment to evaluate web application builds, test client certificate authentication, or run isolated microservice endpoints without polluting the host development machine. Windows Sandbox offers the ideal lightweight testing ground. By authoring a custom Windows Sandbox (.wsb) XML file combined with automated PowerShell logon scripts, you can spin up a fully operational HTTPS web server with trusted local SSL certificates in seconds.

Windows Sandbox Networking and Isolation Model

Windows Sandbox operates inside an ephemeral virtual machine powered by the Hyper-V container architecture. The sandbox receives an isolated IP address via internal virtual NAT. To host an HTTPS server inside the sandbox accessible locally without certificate warnings, the environment requires automated generation and injection of a root Certificate Authority (CA) and leaf SSL certificate upon startup.

Structuring Host Provisioning Files

Create a dedicated configuration directory on your Windows 11 host (for example, C:\SandboxWeb). Include the following files:

C:\SandboxWeb\
├── Start-WebServer.ps1
├── index.html
└── WebServer_Sandbox.wsb

Authoring the Automated HTTPS Provisioning Script

Save the following script as C:\SandboxWeb\Start-WebServer.ps1. This script generates a self-signed certificate, installs it into the local machine Trusted Root store, sets up an HTTP.sys listener with SSL binding, and launches a lightweight static web server:

# Start-WebServer.ps1 - Automated HTTPS Web Server in Sandbox
$WebDir = "C:\SandboxAssets"
$CertSubject = "CN=localhost"

# 1. Create Self-Signed Root Certificate for Local Testing
$Cert = New-SelfSignedCertificate -Subject $CertSubject -DnsName "localhost", "127.0.0.1" `
    -CertStoreLocation "Cert:\LocalMachine\My" -KeyExportPolicy Exportable `
    -NotAfter (Get-Date).AddYears(1)

# 2. Trust the Certificate in the Sandbox Trusted Root Store
$Store = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root", "LocalMachine")
$Store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
$Store.Add($Cert)
$Store.Close()

Write-Host "SSL Certificate created and trusted in LocalMachine\Root." -ForegroundColor Green

# 3. Launch .NET HttpListener on Port 8443 (HTTPS)
$Listener = New-Object System.Net.HttpListener
$Listener.Prefixes.Add("https://localhost:8443/")
$Listener.Prefixes.Add("http://localhost:8080/")

try {
    # Bind certificate to port 8443 via netsh
    $CertHash = $Cert.Thumbprint
    $AppId = [Guid]::NewGuid().ToString("B")
    netsh http add sslcert ipport=0.0.0.0:8443 certhash=$CertHash appid=$AppId | Out-Null
    
    $Listener.Start()
    Write-Host "HTTPS Web Server active at https://localhost:8443/" -ForegroundColor Cyan
    Write-Host "HTTP Web Server active at http://localhost:8080/" -ForegroundColor Yellow
} catch {
    Write-Error "Failed to bind SSL listener: $_"
}

# 4. Launch Edge to verify secure connection
Start-Process "msedge.exe" "https://localhost:8443/"

# 5. Serve basic HTTP requests in loop
while ($Listener.IsListening) {
    $Context = $Listener.GetContext()
    $Response = $Context.Response
    $HtmlContent = "<html><body><h1>Windows Sandbox HTTPS Operational</h1><p>Secure TLS test endpoint active.</p></body></html>"
    $Buffer = [System.Text.Encoding]::UTF8.GetBytes($HtmlContent)
    $Response.ContentLength64 = $Buffer.Length
    $Response.ContentType = "text/html"
    $Output = $Response.OutputStream
    $Output.Write($Buffer, 0, $Buffer.Length)
    $Output.Close()
}

Creating the WSB Configuration File

Create WebServer_Sandbox.wsb to mount the assets directory and trigger the listener on boot:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\SandboxWeb</HostFolder>
      <SandboxFolder>C:\SandboxAssets</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\SandboxAssets\Start-WebServer.ps1</Command>
  </LogonCommand>
</Configuration>

Running and Auditing Secure Endpoints

1. Double-click WebServer_Sandbox.wsb on your Windows 11 workstation.
2. Windows Sandbox spins up in seconds, mounts the host folder, and initiates PowerShell.
3. The script installs the self-signed certificate into the sandbox Trusted Root store and registers the SSL binding on port 8443.
4. Microsoft Edge launches automatically, loading https://localhost:8443/ with a valid secure lock icon and zero certificate warnings.
5. Closing the sandbox immediately deletes all generated certificates, keys, and server processes, leaving the host system completely untangled.