After a week of struggling with this issue, I found a workaround.
In Windows 10 1903 update there is an issue with adding printer with authentication. You have to set port first, even before adding printer, after that, you are able to add it without any issue. Nice script you can edit and run is here
Instructions to add printer https and auth
Script modifying registers and adds port
Or you can add it manually by configuring registers, see second link. After successful adding port and printer(nothing should ask you for credentials), go to printer setting, port setting and configure port with provided credential. Without them, you are unable to print.
Secondly you have to grant access to every location without authentication, even "/" and "/printers" in cupsd.conf. After that, create policy limit <Limit Get-Printer-Attributes> and do not require authentication there at all. Then enable authentication in <Limit Cancel-Job CUPS-Authenticate-Job> and <Limit Create-Job Print-Job Print-URI Validate-Job>.
If you are trying to use self signed certificate, follow link
Self-signed certificate add in Windows. Do not forget to add this certificate to "Trusted root 3rd party certificates"
Some more sources with issues, you have to face, when you are adding IPP printer to Windows
Cups authentication problem Windows
Cups authentication problem Windows
My cupsd.conf(anonymized)
LogLevel debug
PageLogFormat
MaxLogSize 0
SSLPort 636
SSLListen *:636
Browsing On
BrowseLocalProtocols dnssd
BrowseAllow All
DefaultAuthType Basic
WebInterface yes
DefaultEncryption required
ServerKey /etc/cups/ssl/server.key
ServerCertificate /etc/cups/ssl/server.crt
ServerAlias hostname.my_domain.net
# Restrict access to the server...
<Location />
Order allow,deny
Allow 192.168.X1.*
Allow 192.168.X2.*
Allow localhost
</Location>
<Location /printers>
Order allow,deny
Allow 192.168.X1.*
Allow 192.168.X2.*
Allow localhost
</Location>
# Restrict access to the admin pages...
<Location /admin>
Order allow,deny
Allow localhost
Deny all
</Location>
# Restrict access to configuration files...
<Location /admin/conf>
AuthType Default
Require user @SYSTEM
Allow localhost
Order allow,deny
</Location>
# Restrict access to log files...
<Location /admin/log>
AuthType Default
Require user @SYSTEM
Order allow,deny
Allow localhost
</Location>
# Set the default printer/job policies...
<Policy default>
# Job/subscription privacy...
JobPrivateAccess default
JobPrivateValues default
SubscriptionPrivateAccess default
SubscriptionPrivateValues default
# Job-related operations must be done by the owner or an administrator...
<Limit Create-Job Print-Job Print-URI Validate-Job>
Order deny,allow
Allow all
AuthType Basic
Require user @SYSTEM cups_print
</Limit>
<Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
Require user @OWNER @SYSTEM
Order deny,allow
</Limit>
# All administration operations require an administrator to authenticate...
<Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
AuthType Default
Require user @SYSTEM
Order deny,allow
</Limit>
# All printer operations require a printer operator to authenticate...
<Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
AuthType Default
Require user @CUPS_DEFAULT_PRINTOPERATOR_AUTH@
Order deny,allow
</Limit>
# Only the owner or an administrator can cancel or authenticate a job...
<Limit Cancel-Job CUPS-Authenticate-Job>
Require user @OWNER @CUPS_DEFAULT_PRINTOPERATOR_AUTH@ cups_print
AuthType Basic
Order deny,allow
</Limit>
<Limit Get-Printer-Attributes>
Order allow,deny
Allow all
</Limit>
<Limit All>
Order deny,allow
</Limit>
</Policy>
# Set the authenticated printer/job policies...
<Policy authenticated>
# Job/subscription privacy...
JobPrivateAccess default
JobPrivateValues default
SubscriptionPrivateAccess default
SubscriptionPrivateValues default
# Job-related operations must be done by the owner or an administrator...
<Limit Create-Job Print-Job Print-URI Validate-Job>
AuthType Basic
Require user @SYSTEM cups_print
Order deny,allow
</Limit>
<Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
AuthType Default
Require user @OWNER @SYSTEM
Order deny,allow
</Limit>
# All administration operations require an administrator to authenticate...
<Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
AuthType Default
Require user @SYSTEM
Order deny,allow
</Limit>
# All printer operations require a printer operator to authenticate...
<Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
AuthType Default
Require user @CUPS_DEFAULT_PRINTOPERATOR_AUTH@
Order deny,allow
</Limit>
# Only the owner or an administrator can cancel or authenticate a job...
<Limit Cancel-Job CUPS-Authenticate-Job>
AuthType Basic
Require user @OWNER @CUPS_DEFAULT_PRINTOPERATOR_AUTH@ cups_print
Order deny,allow
</Limit>
<Limit Get-Printer-Attributes>
Order allow,deny
Allow all
</Limit>
<Limit All>
Order deny,allow
</Limit>
</Policy>
