iis https problem with pages not showing up

Also, check Microsoft's answers for this issue:

Error "Page Cannot Be Displayed" When You Connect Through HTTPS
http://support.microsoft.com/default.aspx?scid=KB;EN-US;290391

Determine If SSL Connectivity Is Not Working on the Web Server or on an Intermediate Device
http://support.microsoft.com/default.aspx?scid=kb;EN-US;290051

daniel: no firewall, at least not yet. i think i tried all of mskb's recommendations, including the ones you've highlighted, with success, and then some others.

port 443 is open and listening. but i still get the same results.

i'm in a VERY difficult bind and i'm running out of time. r u avail for helping out over the phone on consultancy basis?

tyvvm!

p

r u avail for helping out over the phone on consultancy basis?
--> I'm sorry I'm not (my boss will fire me when he finds out about this ^_^).

Try this quick remedy:
- Open your IIS
- Right click your site
- Select Properties
- Switch to Directory Security tab
- Click Edit button under Secure Communications
- Uncheck Require 128-bit and Require secure channel (SSL) options.

See if that helps.

d: i tried that last recommendation already. if i uncheck BOTH, then i can see this page under "http://localhost/" but that's it.

could there be a problem with the certificate? or how would i be able to check the integrity of the certificate?

d, i'm really in a bind. do you have any who can help? or can you do this after hours?

thanks.

psg

Wait a minute -> http://localhost/ ???
SSL can only run under the specific domain name, ie. if you order from verisign for: mydomain.com (without www), then you can't run https://www.mydomain.com.
You have to run it under https://mydomain.com.

Please use the full domain name you used when you created your SSL certificate request, and it will solve your problem (I hope).

this is what i have: i have my own server (dell poweredge) with own ip address, and dns setup with a 'vanity' domain name (http://synergy.columbia.edu). in iis, i have the default web site (unsecured, port 80). then i have another web site under the same server (only one!) called 'synergy lab portal' which is the secure web site. has the certificate installed, port 443 enabled, etc.

the unsecured website uses 'default.htm' as the default page.

the secure 'synergy lab portal' uses 'default.asp' as the default page.

one funny thing: as a test, i secured the 'unsecured' web site, and got the same problem. is it the certificate? i created it.

to answer your question: i browsed the secured 'synergy lab portal' directly from the iis (internet services manager) console. and that's how the http://localhost pops up, and gives me that 'the page must be viewed over a secure channel' message. then when i switch the http to https (e.g., https://synergy.columbia.edu, it then says 'the page cannot be displayed.').

again, could it be the certificate? or am i over my head in this? thanks again! p

Probably, I'm not so clear now.

Please explain to me how you set your ssl certificate up? Who  issued your SSL certificate? And have you received and installed the CSR Certificate?

- Open your IIS
- Right Click your website
- Select Properties
- Switch to Directory Security tab
- Under Secure Communication, click View Certificate button

Is it valid certificate?

i created the ssl certificate. then installed it to the secured site. i can email you the certificate if you wish.

i tried recreating the certificate, by reinstalling 'certification authority' (certificate services) in w2k server, just to make sure. but i still get the same thing.

am i missing something in the process?

thanks so much.

p

to your last question:

certificate status: 'this certificate is ok.'

funny: am i stupid or something? there's a key in the general tab: 'you have a private key that corresponds to this certificate'.

what am i missing here?

No, you're not stupid. Most of the time, it is usually a simple thing that we miss.
It's rather difficult now for me to figure it out, since it seems like you have set it up properly.

Here is what I found from IIS support:

If you're getting "Page cannot be displayed", then there's several reasons
for this:

1.  You dont' have port 443 defined as your SSL port.

2.  You're using SSL on a site other than the default web site.

PRB: "Page Cannot Be Displayed" When You Connect Through HTTPS
http://support.microsoft.com/support/kb/articles/Q290/3/91.asp

3.  Port 443 is in use by another application.

Web Services Fail with "IP Address Already in Use" Error Message
http://support.microsoft.com/support/kb/articles/Q261/1/94.asp

4.  You're connecting through a firewall that does not have port 443 open.

5.  You're trying to use host headers with SSL.

HTTP 1.1 Host Headers Are Not Supported When You Use SSL
http://support.microsoft.com/support/kb/articles/Q187/5/04.asp

6.  You're using the wrong type of certificate.

Err Msg: The Page Cannot Be Displayed . . .  
http://support.microsoft.com/support/kb/articles/Q265/8/47.asp

To help narrow down which problem you're dealing with, use this article:

HOWTO: Determine If SSL Connectivity Is Failing on the WebServer
http://support.microsoft.com/support/kb/articles/Q290/0/51.asp

Please look at them. They might be useful.

d:

i think i tried nearly all of the above. but i will check again. thanks for staying with me.

another thing that might be screwing things up: i use fp2002 to author the pages, and the server has fp2002 extensions managed via sharepoint. could this affect the https?

thanks again.

Or, is that page not found a result of your custom error message page?

- Open your IIS
- Right click your site
- Select Properties
- Switch to Custom Errors
- Check under HTTP Error colum: 403;4 -> is it going to common default page or your own custom page?

under 'error mapping properties'

403;4 is going to the 'c:\winnt\help\iishelp\common\403-4.htm' file.

any clues?

thanks.

I just tried to telnet to synergy.columbia.edu through port 443, and it didn't work.
Are you 100% sure you don't have firewall blocking it?
Where you host it? Have you recheck with your ISP administrator regarding this?

d: i got desperate and decided to start from SCRATCH! so i just installed the 'certification authority' AGAIN, keeping tabs of what i'm doing. still same crap.

i even tried to fiddle with the host header names: same thing, it wouldn't matter anyways.

do you think the fp2002 extensions have to do anything with this problem?

to address your latest ?s: i'm working from home and using pcanywhere to tap 2 workstations and the server and this is what i seeing...

from within the server and from another workstation (on the same subnet) i'm able to do a tracert to see if 443 is being routed thru. and then i was able to telnet to 156.111.7.228 443 and noticed on netstat on the server that the server's https is being called upon.

i own the machine so there's no firewall. so i am the administrator for this machine.

there is however a funny thing going on (and i just tested from my home pc using my cable internet connection):

that i can't even ping to the any machine on campus. but i can ping between workstations and the server. is there something that i am missing about my network topology, something i'm not aware of?

thanks again.

p

Just curious, please check again your website setting. Is port 443 still set there?
The reason I'm asking this because I found out the same case as yours and here what she said:
"About 2 weeks later, still having no luck, I found information indicating that changes made in Key Manager sometimes wipe out that port setting. I went back and
checked and sure enough, the SSL port setting was now blank! I reset it to 443, restarted the server, and now it's working. "

Worth to try right? :-)
It should be simple thing, we just don't know what it is yet.

Make sure 443 is open (I know you have mentioned it couple times, but just want to make it 200% sure ^_^).
Run this from your server, it will show you what ports are open (this time make sure 443 is one of them):
http://grc.com/x/ne.dll?rh1dkyd2

i tried to open the https://synergy.cpmc.columbia.edu, got the same failure. and this is what i see on netstat of the server:

C:\>netstat -n

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    127.0.0.1:3007         127.0.0.1:3008         ESTABLISHED
  TCP    127.0.0.1:3008         127.0.0.1:3007         ESTABLISHED
  TCP    127.0.0.1:3009         127.0.0.1:3011         ESTABLISHED
  TCP    127.0.0.1:3011         127.0.0.1:3009         ESTABLISHED
  TCP    156.111.7.228:443      156.111.7.228:3158     TIME_WAIT
  TCP    156.111.7.228:443      156.111.7.228:3159     TIME_WAIT
  TCP    156.111.7.228:5631     24.45.219.54:4986      ESTABLISHED

the server is the 156.111.7.228 machine.

so, unless i'm reading this wrong... the server is replying.

thanks so much! p

btw, d: i'm running netstat to update every 5 secs, and after closing the web page (requesting the https connection), netstat shows:

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    127.0.0.1:3007         127.0.0.1:3008         ESTABLISHED
  TCP    127.0.0.1:3008         127.0.0.1:3007         ESTABLISHED
  TCP    127.0.0.1:3009         127.0.0.1:3011         ESTABLISHED
  TCP    127.0.0.1:3011         127.0.0.1:3009         ESTABLISHED
  TCP    156.111.7.228:3204     156.111.7.126:139      TIME_WAIT
  TCP    156.111.7.228:5631     24.45.219.54:4986      ESTABLISHED
  TCP    192.168.0.1:3205       192.168.0.2:139        TIME_WAIT

so, it seems to be in order?

thanks.

p

Okay, last thread before I sleep...
Have you tried my suggestion above?

- Open your IIS
- Right click your site - Select Properties
- Make sure you are in Website tab
- Click Advanced button next to your website IP address
- Check, does your website IP address (156.111.7.228) exist under "Multiple SSL identities..."?

If not, click Add button, add your IP address (156.111.7.228) and port 443.
If it does exist, then we need to figure out other way to resolve this problem.

yes, david i tried that already, and other variations to the multiple ssl identities (e.g., with the 156 ip address, unassigned, etc), but no success. again, thanks for staying with me and trying to help out this enigma! pablo

Hi Pablo,
How is the SSL coming?
If it still doesn't work, try to install FileMon from sysinternal (http://www.sysinternals.com/ntw2k/source/filemon.shtml) in your webserver.
Run the secured page again, and see in the filemon list what could be blocking it.

Hope that helps.

PortMon (Port Monitoring) might also be useful: http://www.sysinternals.com/ntw2k/freeware/portmon.shtml

still having the problem. i'll try your solution. thanks. you know, i tried calling our university support group. but of course, no one in the bureaucratic network couldn't  tell me if there was a NAT in place.  but i thought that tracert would pick it up. let's see if filemon or portmon can help.

no one in the bureaucratic network couldn't  tell me if there was a NAT in place.
--> hehehe... love that term -> bureaucratic network.

Let me know the result. I'm curious too - your SSL problem is very unique.

FYI, probably can be helpful for you:

SSL Diagnostic Utility Download for IIS
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windowsserver2003/downloads/ssldiags.asp

d: thanks again for staying w/ me. haven't resolved the problem yet. however, there may be something going on that has been detected w/ that ssl diagnostic utility. this is what the utility shows. i can barely make sense of what this says, particularly at the bottom of the report. have you had any experience w/ this? thanks again. p

System time: Wed, 22 Oct 2003 01:21:43 GMT
ModuleFileName: C:\Program Files\Microsoft\SSL Diagnostics\SSLDiag.exe
OS: Windows 2000 Service Pack 4
IIS5 - World Wide Web Publishing (W3SVC) service is installed

[ HKLM\System\CurrentControlSet\Services\InetInfo\Parameters ]
CertChainCacheOnlyUrlRetrieval = True(default)
CheckCertRevocation = False(default)
CertChainCheckUsage = False(default)
sspifilt.dll loaded into process 1264 (inetinfo.exe)

[ SChannel Info ]
CacheSize = 10000
Entries = 0
ActiveEntries = 0

[ W3SVC/2 ]
ServerComment = Administration Web Site
ServerAutoStart = True
ServerState = Server started

[ W3SVC/1 ]
ServerComment = Default Web Site
ServerAutoStart = True
ServerState = Server started

[ W3SVC/1/Root ]
AccessSSLFlags = 0 (0x0)

[ W3SVC/1/Root/_vti_pvt ]
AccessSSLFlags = 0 (0x0)

[ W3SVC/1/Root/_vti_log ]
AccessSSLFlags = 0 (0x0)

[ W3SVC/1/Root/_private ]
AccessSSLFlags = 0 (0x0)

[ W3SVC/1/Root/_vti_script ]
AccessSSLFlags = 0 (0x0)

[ W3SVC/1/Root/fpdb ]
AccessSSLFlags = 0 (0x0)

[ W3SVC/1/Root/_vti_txt ]
AccessSSLFlags = 0 (0x0)

[ W3SVC/1/Root/_vti_bin ]
AccessSSLFlags = 0 (0x0)

[ W3SVC/3 ]
ServerComment = Microsoft SharePoint Administration
ServerAutoStart = True
ServerState = Server started

[ W3SVC/4 ]
ServerComment = Synergy Lab Portal
ServerAutoStart = True
ServerState = Server started
#Could not impersonate server account
SSLCertHash = 73 46 9e 13 89 cb ff 42 f6 df 64 ad 79 4d f8 e8 50 97 0f 90
SSLStoreName = MY
#CertName = 3WCFSDC
#You have a private key that corresponds to this certificate
#ContainerName='3WCFSDC'
#ProvName='Microsoft Base Cryptographic Provider v1.0' ProvType=PROV_RSA_FULL KeySpec=AT_SIGNATURE
#Subject: E=synergy@columbia.edu, C=US, S=NY, L=New York, O=CF Referral Center for Susceptibility and Synergy Studies, OU=Columbia University, CN=3WCFSDC
#Issuer: E=synergy@columbia.edu, C=US, S=NY, L=New York, O=CF Referral Center for Susceptibility and Synergy Studies, OU=Columbia University, CN=3WCFSDC
#Validity: From 10/13/2003 9:12:34 PM To 10/13/2004 9:12:56 PM
SecureBindings = 156.111.7.228:443:

[ W3SVC/4/Root ]
AccessSSLFlags = 264 (0x108)
AccessSSL = True
AccessSSL128 = True
AccessSSLNegotiateCert = False
AccessSSLRequireCert = False
AccessSSLMapCert = False

d: i also ran the ssl probe and got this:

System time: Wed, 22 Oct 2003 01:26:05 GMT
Connecting to 156.111.7.228:443
Connected
Handshake: 108 bytes sent
Handshake: 1082 bytes received
Handshake: 182 bytes sent
#WARNING:Handshake: unspecified error receiving data
#WARNING:Handshake: 0x80090304 (-2146893052) error

any ideas on the error code? thanks again.

Are you running virtual websites? I.e. more than one website on one IP?
Then there is the problem, you need to have the site with SSL on one IP only used by the SSL...

thanks for your comment. forgive me, but i was under the impression that virtual sites can be ssl'ed. are u saying that if i wanted to host a secure and unsecure sites, i would need a dedicated ip address for each? if true, then i was spinning my wheels based on misinformation!

thanks and i eagerly wait your reply.

p

Each Web site must have a unique combination of identification characteristics. Therefore, while multiple Web sites can share two of their three identification characteristics, (domain or host header name, IP address, and port), they must have one characteristic that is different. Also, because SSL certificates contain the domain name in them, Web sites using certificates cannot share an IP address with other Web sites.

I'm still having the same problem
I have on my machine both the cert server and IIS. I created my own certificate and installed it into IIS.
I followed all your suggestions but it still doesn't work.
My computer name is fi_pc240 and I try to connect to this url:
https://fi_pc240/test.htm

if i try http://fi_pc240/test.htm, it obviously works.

thanks in advance.

Bussola (from Italy)