Groups | Blog | Home
all groups > iis security > february 2004 >

iis security : Renewed Certificate not working



Hasnain
2/13/2004 11:08:39 AM
Hi,

I have got an strange issue.

The problem is, I have just renewed a certificate but its not working i.e.
it has been installed properly, visible in request and personal folder in
'certificate snap-in' in MMC, valid date till 2005 but.the site is
inaccessible with https:// It was working fine with the previous
certificate, which expired, so we asked for a renewed certificate.



I first tried with replace certificate, which didn't work, although the
certificate was installed properly.



Then I start from the scratch and remove all previous entries, install the
new certificate again, which was installed properly again, but didn't work.
I then even tried to install free sample 30 days certificate which was
installed but again, site didn't respond on https:// and keep giving "The
page cannot be displayed" error. The last line in the browser says "Cannot
find server or DNS Error" so I have tried to run the site using its IP in
order to bypass DNS but id didn't work either. Above all it was working fine
earlier. The same IP was also being used by other sites in such a way that
all were directing to same 'home directory', so I removed all the rest of
the sites too.



Do anyone of you have any solution for this. I will really appreciate it as
I m completely stuck for the last three days.



Thanks in advance,



Hasnain

Internal Support Manager



Hasnain
2/13/2004 4:36:51 PM
The problem now is, the renewed certificate indicate no error anywhere but
the site is unaccessible from https://
One more thing, we have another site working with a different certificate on
the same server, from same authority.

[quoted text, click to view]

Bernard
2/13/2004 6:26:47 PM
Sorry, so the problem now is renewed cert not working or you still getting
cannot find dns error ?

--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...


[quoted text, click to view]

Hasnain
2/13/2004 7:59:57 PM
not working means that we are getting DNS error.

[quoted text, click to view]

Bernard
2/15/2004 9:40:29 PM
so you have at least 2 SSL in one box, are they binding at different IP or
ports ?
when you do 'netstat -an' do you see 2 binding on port 443 ?

and try -
PRB: Error "Page Cannot Be Displayed" When You Connect Through HTTPS
http://support.microsoft.com/?id=290391


"Cannot find server" or "DNS" Errors When Using SSL (Q & A)
http://support.microsoft.com/?id=292296


--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...


[quoted text, click to view]

Hasnain
2/16/2004 10:50:06 AM
Those two SSL are on the same box, binded to diffrenet IPs but using same
port number i.e. 443.

When I use netstat -an I got so many lines, I hope the following lines you
might be interested in:

Proto Local Address Foreing Address State
TCP 0:0:0:0:443 0.0.0.0 LISTENING
UDP "PC IP":53 *:*
UDP "PC IP":500 *:*
UDP "PC IP":5632 *:*

Thanks for the article you mentioned. I had already gone through the article
290391 but 292296 was new to me, but I don't think removing the binding from
default web site will work as the other site having another valid
certificate (from the same source) is already working perfectly. Do I need
to assign different SSL port for another another web site?

Please help,

thanks,

Hasnain.


[quoted text, click to view]

Hasnain
2/16/2004 2:24:53 PM
Its already binded to its own IP with port SSL 443.
The default web site properties indicate 'All assigned' for SSL 443

[quoted text, click to view]

Bernard
2/16/2004 3:29:20 PM
Ok now, you have to make sure each cert is binding to its own IP.
IIS MMC - Site's properties - Web site tab - Advanced button,
at the SSL section, click edit - change 'all unassigned' to its IP.

now, you might want to try SSL diag as well.
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windowsserver2003/downloads/ssldiags.asp

this will help diagnose SSL error for you. FYI, I have one IP 2 sites with
2 certs. binding on different ports.

--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...


[quoted text, click to view]

Hasnain
2/16/2004 4:18:30 PM
I just change the assigned IP and it start working through its new IP both
with http and https. I didn't make any changes to DNS so far, so access the
site using its new public IP. Then I revert back its previous public IP and
the site start giving 'The page cannot be found' and 'DNS Error' in the
last, although I was accessing the site through its IP on both the cases. I
have also gone through IIS to verify that its IP is not being shared with
any other site.


[quoted text, click to view]

Bernard
2/16/2004 6:24:38 PM
Configured the 2 sites to bind on their own IP at port 80 and 443.

download ssldiag and post the error msgs here.


--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...


[quoted text, click to view]

Bernard
2/25/2004 2:25:36 PM
sounds like your previous IP can't establish SSL connection.
is there any firewall or router blocking ? can you browser locally ?

have try recreate the web site ? and ssldiag ?

--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...


[quoted text, click to view]

AddThis Social Bookmark Button