IPP over TLS (IPPS) port closed — open 631 and test with curl

Q: Why is IPPS (IPP over TLS) not working?

Port 631/tcp may be blocked, CUPS may not be listening on 631, the IPP path may be wrong, or the certificate is untrusted. Open 631, set Listen *:631, use the correct ipps://host:631/printers/QUEUE URI, and trust the CA.

Q: How do I open port 631 on Linux?

On UFW run: sudo ufw allow 631/tcp. On firewalld run: sudo firewall-cmd --add-service=ipp --permanent && sudo firewall-cmd --reload. Restart CUPS and verify with ss -ltn | grep :631.

Q: How do I test IPPS with curl?

Use curl -vk ipps://host:631/ or curl -vk ipps://host:631/printers/QUEUE. A response indicates the port is open and TLS is working. Use ipptool -tv for detailed printer attributes.

Q: Windows 10/11 can’t add the IPPS printer — what now?

Open inbound 631/tcp on the server if needed, import the printer's CA certificate if private, add using ipps:// URL and choose the vendor driver instead of a generic class driver.

Q: What’s the difference between IPP, IPPS, LPD, and RAW 9100?

IPP is HTTP-based printing; IPPS is IPP over TLS (encrypted). LPD/515 and RAW/9100 are legacy and often unencrypted; prefer IPPS for security.

Updated: September 27, 2025 · Answered by Joe B. in 3 mins

Joe B.

Reviewed for technical accuracy

Specialities: Windows 11/10, macOS (Sonoma/Ventura/Monterey), CUPS/IPP/IPPS, Networking, Office Equipment

IPPS (IPP over TLS) not working — port 631 closed or filtered on Windows, macOS, Linux, CUPS, HP, Epson, Canon, Brother

Technician

Hey! We can get IPP over TLS (IPPS) online quickly. Tell me: is the printer or print server running CUPS, Windows Print Spooler, or an embedded web server (HP/Epson/Canon/Brother)? Also share the host/IP and whether discovery via Bonjour/mDNS (_ipps._tcp) or AirPrint works. We’ll check if port 631/tcp is closed, blocked by firewall, or not listening, then verify TLS and the certificate chain.

Customer

Ubuntu server with CUPS. Clients are Windows 11 laptops and a Mac. The IPPS queue won’t add and printing fails. Nmap says 631/tcp filtered. How do I open 631 and test IPPS with curl?

Technician

Common causes when IPPS is not working or IPP port 631 is closed:
• Firewall blocks 631/tcp (ufw, firewalld, cloud NACL, or Windows Defender Firewall).
• CUPS not listening on 631 (missing Listen *:631), or Encryption Required with a bad TLS setup.
• Certificate issues: self-signed or expired cert, wrong hostname/SAN, or clients don’t trust the CA.
• Wrong IPP URI (use ipps://host:631/printers/QUEUE or ipps://host:631/ipp/print).
• Legacy protocols (LPD 515 or RAW 9100) enabled but IPPS/631 disabled.
Let’s open the port, enable TLS in CUPS, then test with curl/ipptool so Windows/macOS can add the secure queue.

Customer

What are the exact commands on Ubuntu to open 631 and enable IPPS in CUPS?

Technician

Open IPP/IPPS port 631 and enable CUPS over TLS (Ubuntu/Debian):
1) Allow TCP/631 in the host firewall:
  • UFW: sudo ufw allow 631/tcp comment 'CUPS IPP/IPPS'
  • firewalld: sudo firewall-cmd --add-service=ipp --permanent && sudo firewall-cmd --reload
2) Make CUPS listen on 631 and expose the web UI (optional):
  sudo cupsctl WebInterface=yes
  sudo cupsctl --remote-admin --remote-any --share-printers
  Ensure /etc/cups/cupsd.conf has Listen *:631 (or the server IP).
3) Require encryption for administration/printing and set certificate paths (CUPS maintains its own certs by default):
  sudo cupsctl DefaultEncryption=Required
4) Restart CUPS: sudo systemctl restart cups
5) Verify it’s listening: ss -ltn | grep :631 → should show LISTEN on 0.0.0.0:631 and/or [::]:631.

Customer

How do I test the IPPS endpoint with curl and check TLS?

Technician

Test IPPS with curl (quick checks):
• Basic reachability/TLS handshake:
curl -vk ipps://<HOST>:631/ — a 403/401 or redirect means port 631 is open and TLS works.
• Check a specific CUPS queue:
curl -vk ipps://<HOST>:631/printers/<QUEUE>
• If you use a self-signed or private CA, add trust on the client or temporarily use -k while testing. Inspect the server cert:
openssl s_client -connect <HOST>:631 -servername <HOSTNAME> -showcerts
Confirm the CN/SAN matches the hostname and the chain is valid. For functional IPP tests, ipptool is ideal:
ipptool -tv ipps://<HOST>:631/printers/<QUEUE> get-printer-attributes.test

Customer

Windows clients can’t add the printer via IPPS. Any Windows firewall or spooler steps?

Technician

Windows 10/11 — allow IPP/IPPS and add the printer:
• Ensure outbound 631/tcp is allowed (default). If hosting CUPS on Windows Server/Print Server, open inbound:
New-NetFirewallRule -DisplayName "CUPS IPP 631" -Direction Inbound -Protocol TCP -LocalPort 631 -Action Allow
• Verify service reachability:
Test-NetConnection -ComputerName <HOST> -Port 631
• Add via Settings → Bluetooth & devices → Printers & scanners → Add → Add manually → Use a TCP/IP address or hostname → enter ipps://<HOST>:631/printers/<QUEUE> (or device URI shown by CUPS). If Windows picks a class driver, switch to the vendor driver.
• If cert is private, import the CA cert to Trusted Root Certification Authorities so IPPS validation passes.

Customer

What about macOS? AirPrint sees the device but secure printing fails.

Technician

macOS — add secure IPP and trust the cert:
• Confirm discovery advertises _ipps._tcp (Bonjour). You can also add directly with the URL: ipps://<HOST>:631/printers/<QUEUE>.
• If you use a private CA or self-signed cert, import it into Keychain Access → System → Certificates and set Always Trust.
• Enable the CUPS web UI for checks: sudo cupsctl WebInterface=yes then open http://localhost:631 (admin only). macOS will use TLS automatically when the URI is ipps://.

Customer

Nmap shows 631 open now, but jobs still fail. Could it be the IPP path or CUPS permissions?

Technician

Correct IPP paths and auth:
• Typical URIs: ipps://<HOST>:631/printers/<QUEUE> (queue) or ipps://<HOST>:631/ipp/print (default destination).
• Test authentication with ipptool:
ipptool -tv -u user:pass ipps://<HOST>:631/printers/<QUEUE> get-printer-attributes.test
• In cupsd.conf, ensure your <Location /printers/> allows the right methods and uses AuthType (Basic over TLS is common). Restart CUPS after edits and retest with curl -vk.

Customer

Do embedded printers (HP/Epson/Canon/Brother) expose IPPS differently?

Technician

Brand specifics — HP / Epson / Canon / Brother (embedded web servers):
• Enable IPP/IPPS in the network/printing settings; some models label it Web Services or AirPrint.
• Ensure RAW 9100 or LPD 515 aren’t the only services enabled — you need IPP(631) with TLS.
• Upload a certificate (PEM) or create a CSR on the device; match CN/SAN to the printer hostname used by clients.
• For discovery, verify Bonjour/_ipps._tcp is on. Then test with curl -vk ipps://<PRINTER>:631/ipp/print.

Customer

Any quick checklist to confirm IPPS end-to-end?

Technician

IPPS checklist (open 631 and validate):
1) Socket open: ss -ltn on server → 631 listening.
2) Firewall: allow 631/tcp (UFW/firewalld/Windows).
3) CUPS: Listen *:631 and DefaultEncryption=Required; restart.
4) TLS: cert CN/SAN matches hostname; chain trusted on clients.
5) URI: correct path (/printers/QUEUE or /ipp/print).
6) Test: curl -vk ipps://host:631/printers/QUEUE and ipptool -tv ... get-printer-attributes.test.
7) Add on Windows/macOS using ipps://. If Windows picks a class driver, switch to the vendor driver.

Customer

Great — port 631 is open, curl works, and clients can add the secure IPP queue. Thanks!

Technician

Summary: If IPPS is not working or IPP port 631 appears closed, open the firewall, make CUPS or the printer listen on 631, fix TLS certificates, and verify with curl -vk ipps://host:631/ and ipptool. Add printers via ipps:// URLs on Windows 10/11 and macOS. Need hands-on help with CUPS, Windows Print Spooler, AirPrint, or certificates? Open the chat.

Quick answer: the accepted fix

Accepted fix when IPPS (IPP over TLS) not working or port 631 is closed: Allow TCP/631 in the firewall, ensure CUPS/Print Server listens on 631 with DefaultEncryption=Required, install a valid certificate (or trust your CA), and test with curl/ipptool using the correct ipps://host:631/printers/QUEUE URI.

IPPS fails after updates — TLS or firewall changed (Windows/macOS/Linux)

Updates can tighten TLS policies or switch drivers. Re-check that port 631 is open, CUPS still has Listen *:631 configured, and the certificate is valid (CN/SAN and expiry). On Windows, re-enable inbound rules or group policy allowing IPPS. Re-add the printer using ipps:// rather than LPD/RAW to enforce encryption.

How to verify IPPS end-to-end

Run curl -vk ipps://host:631/printers/QUEUE and expect a response (403/401/200). Then use ipptool -tv to fetch attributes. From Windows, Test-NetConnection -Port 631 confirms reachability; on Linux, ss -ltn | grep :631 proves the listener. If TLS fails, import the CA certificate on each client and retest.

IPPS — troubleshooting tips

Most IPPS issues are firewall blocks, wrong IPP path, or certificate trust.

Quick path: open 631/tcp → set Listen *:631 in cupsd.conf → enable DefaultEncryption → verify the ipps:// URI and certificate → test with curl and ipptool. For embedded printers (HP/Epson/Canon/Brother), enable IPP/IPPS and upload a cert that matches the hostname used by clients.

Disclaimer: This information is AI-generated and intended for general guidance only. For advice specific to your environment, please consult a verified expert on Whizz-Tech before making decisions.

Getting Started Is Easy

Ask for help, 24/7

Members enjoy round-the-clock access to 12,000+ verified Experts, including tech support, mechanics, vets, and more.

Expert will respond in minutes

We match you with an Expert who specializes in your situation. Talk, text, or chat — whichever you prefer.

Save time & money

No scheduling hassles or expensive consults. Membership can save you significant time and money each month.

FAQ

Why is IPPS (IPP over TLS) not working?

Usually port 631/tcp is blocked by a firewall, CUPS is not listening on 631, the IPP path is wrong, or the certificate is untrusted/expired. Open 631, set Listen *:631, use the correct ipps://host:631/printers/QUEUE URI, and trust the CA.

How do I open port 631 on Linux?

For UFW: sudo ufw allow 631/tcp. For firewalld: sudo firewall-cmd --add-service=ipp --permanent && sudo firewall-cmd --reload. Then restart CUPS and verify with ss -ltn | grep :631.

How do I test IPPS with curl?

Run curl -vk ipps://host:631/ or curl -vk ipps://host:631/printers/QUEUE. A response (401/403/200) confirms 631 is reachable and TLS works. Use ipptool -tv for printer attributes.

Windows 10/11 can’t add the IPPS printer — what now?

Create an inbound firewall rule for 631 if the server is Windows; import the printer’s CA certificate if it’s private; add using the ipps:// URL and choose the vendor driver instead of a generic class driver.

What’s the difference between IPP, IPPS, LPD, and RAW 9100?

IPP is the modern HTTP-based protocol for printing. IPPS is IPP over TLS (encrypted). LPD/515 and RAW/9100 are legacy/unencrypted and often blocked by policy; prefer IPPS for security and compatibility.

Common IPPS problems and quick fixes
Symptom	Likely cause	Quick fix
Port 631 closed/filtered	Host firewall/NACL blocking	Allow 631/tcp (UFW/firewalld/Windows)
TLS handshake fails	Untrusted or mismatched certificate	Install valid cert; import CA on clients; use correct hostname
Jobs fail at submit	Wrong IPP path or auth	Use `/printers/QUEUE` or `/ipp/print`; set AuthType; test with ipptool
Discovered via AirPrint but can’t add	_ipps._tcp off or TLS policy	Enable Bonjour/_ipps._tcp; enforce IPPS; trust certificate

Step-by-step (Windows 10/11)

On the server (if Windows): open inbound 631/tcp with New-NetFirewallRule; on clients, ensure outbound 631 allowed.
Verify reachability: Test-NetConnection -ComputerName host -Port 631.
Add printer manually using ipps://host:631/printers/QUEUE; pick the vendor driver.
If using a private CA, import the CA certificate into Trusted Root Certification Authorities.

Step-by-step (Linux/macOS server with CUPS)

Open the firewall (UFW/firewalld) for TCP 631.
Enable CUPS on 631: cupsctl WebInterface=yes, cupsctl --remote-admin --remote-any --share-printers, and confirm Listen *:631.
Require encryption: cupsctl DefaultEncryption=Required; ensure the certificate/hostname is valid.
Restart CUPS, then test: curl -vk ipps://host:631/ and ipptool -tv ipps://host:631/printers/QUEUE get-printer-attributes.test.

Sources

Filed under: Printers

Joe B.

IPPS (IPP over TLS) not working — port 631 closed or filtered on Windows, macOS, Linux, CUPS, HP, Epson, Canon, Brother

Quick answer: the accepted fix

IPPS fails after updates — TLS or firewall changed (Windows/macOS/Linux)

How to verify IPPS end-to-end

IPPS — troubleshooting tips

Getting Started Is Easy

Ask for help, 24/7

Expert will respond in minutes

Save time & money

FAQ

Step-by-step (Windows 10/11)

Step-by-step (Linux/macOS server with CUPS)

Sources

Related articles