Hello all, and thanks for taking time to view this question.
I am having issues with a verisign security certificate that I have been trying (unsuccessfully) to apply to one of our production servers. Here are some of the things I've tried, and the results I've had:
1.) right click on "default web site" and go to properties --> directory security --> server certificate. Then, to apply the cert, I go through the IIS certificate steps, select the correct cert and proceed from there.
2.) Now, I can see that the cert is now active. I can click "view certificate" and see all the certificate details. Since I want to enable the security certificate and require SSL communications, I go to "Edit" and check the top checkbox: "Require secure channel (SSL)"
The other settings on the screen are "Ignore client certificates" (radio button that is checked). All other options are left blank.
When I do this, I try to access my page again, and of course it tells me:
---
Secure Channel Required
This Virtual Directory requires a browser that supports the configured encryption options.
---
Okay -- so then I looked it up and found that this error is error number 403.4 to IIS. So, I tried placing a custom page there that grabs any form data and / or querystring data and posts it to the https:// page. My two problems follow:
1.) The redirect page in the "custom errors" on IIS for 403.4 does not fire when the error occurs. Instead I get the above mentioned error.
2.) Even if the 403.4 page DID work, when I try to navigate to my site via "https://mysite.mydomain.s
Thanks to anyone who might be able to help!!
Best Regards,
peh803
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
If you're using Internet Explorer you can go to https://yoursite and if you get the little lock icon on the bottom right corner, double click on it and it will tell you "Issued To: sub-domain.domain.prefix" and that's what you have to use the SSL on.
right -- unfortunately, I can't get to the page with the "lock icon". https://subdomain.mysite.s
Sorry -- I can't ever get to the https:// page in the first place, which is probably a bigger problem than the 403.4 error page..
Thanks again for any further insights you might have to provide.
The Subject properties are written as follows:
CN = subdomain.site.suffix
OU = Terms of use at www.verisign.com/rpa (c)00
OU = DepartmentName
O = CompanyName
L = City
S = State
C = Country
Does that look okay to you?
yeah, looks fine as long as it has your real info in there and not really what you just typed. for example, paypal's is...
CN = www.paypal.com
OU = Terms of use at www.verisign.com/rpa (c)00
OU = Information Systems
O = Paypal, Inc.
L = Palo Alto
S = California
C = US
yes, that's it. But the first one... the domain is "racf.nwie.net"....
This is indeed the site we're trying to go to via https://. Currently, without "Require secure channel (SSL)", users go to this page at http://racf.nwie.net
We want the page instead to be https://racf.nwie.net. When we click "Require secure channel (SSL)", we get the aforementioned error on the http:// page, and the https:// page does not display.
Thanks again for the good help thus far.
Regards,
peh803
First of all, be sure to deselect "Require secure channel" on the custom error page you designed or your users can't see it..... :-)
Second, have you tried using SSLDiag on the machine? http://www.microsoft.com/d
Try downloading this and see if it shows you anything.
On a slightly easier note, when you view the details of the certificate does it say you have a private key?
Are there any SCHANNEL errors being logged in the event logs?
Can you browse the site from the server itself?
Do you have more than one SSL site on the machine? Using Host Headers?
Do you have a firewall that may be blocking port 443?
Dave Dietz
>>First of all, be sure to deselect "Require secure channel" on the custom error page you designed or your users can't see it..... :-)
I know that seems like "DUH!!", but it was indeed my problem with the custom page, so thanks very much for that.
Checking into the other items now.
I am well-versed in ASP, but I have limited experience with https:// security certificate application, so I really appreciate the help.
Best regards,
peh803
>>Are there any SCHANNEL errors being logged in the event logs?
I don't see any -- not sure I'm looking in the right place. Went to Start --> Programs --> Administrative Tools --> Event Viewer, and looked in the application log, security log, and system log for anything that said "SCHANNEL" and I didn't see anything, but perhaps this is not the right place to look?
Thank you,
peh803
Sorry -- I must make a correction:
>>On a slightly easier note, when you view the details of the certificate does it say you have a private key?
Earlier I said no -- but it actually does say that we have a private key. Specifically, it states: "You have a private key that corresponds to this certificate." Sorry about that.
>>Do you have more than one SSL site on the machine? Using Host Headers?
The site in question is the only site on the server. The only other thing is a VC++ COM component, but I wouldn't think that this would cause trouble.
>>Do you have a firewall that may be blocking port 443?
No.
I have to get my manager's clearance to install the SSLDiag on the server, since this is a production server. If / when I do that, I will let you know.
Based on the info provided, do you have any eurekas, further suggestions, or recommendations?
Thanks very much for your help thus far.
Best Regards,
peh803
Can you create a new site on the server and set it's TCP port to 443?
Then try browsing to http://serverip:443 and see if you can connect to port 443 at all.....
Dave Dietz
First, I would like to thank everyone for helping me out here.
I have run SSLDiag on the server, and this has uncovered several *other* issues that I am currently working on taking care of. Because Dave's suggestion led me to SSLDiag, I have awarded him the lion's share of the points.
Thanks again to all for the wonderful help.
Best Regards,
peh803
I looked through this post and although it helped me solve some issues-I'm yet to solve the biggest one. I am still unable to automatically redirect. I end up with an error -
"Secure Channel Required
This Virtual Directory requires a browser that supports the configured encryption options."
I've done everything mentioned on this post and ensured that my server is configured properly. I used SSLDiag and simulated a handshake that eventually came down to
Handshake succeeded
--------
------
------
----
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
Connection Close
Does anyone know what I could possibly do? It looks like the cert is installed and it works because when i type in https://www.mydomain.com- my website pops up. Its only the redirect that doesnt seem to work.
Business Accounts
Answer for Membership
by: mastallamaPosted on 2005-02-08 at 09:10:30ID: 13256146
i had a similar problem before on one of my servers, check and make sure you're going to the right site under HTTPS, whenever you purchased the SSL you had to supply a domain name. if you didn't put a www. or any other sub-domain infront of your domain when you purchased the SSL (it was actually entered in the form on the server when creating the CERT file) then you need to use "HTTPS://yourdomain.suffix