Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 516
  • Last Modified:

Can't connect to internal web server via application

I have a connection for an external customer on an external web server to an internal web server via https (443) using web services. Both are recently created Windows 2008 R2 64bit servers using IIS7. I can't get the certificate to install correctly by installing it from the certificate error page. I thought i could install it using the servers certificate.
The external server in an a workgroup and in the internal web server is in a domain.

However my knowledge of certificates is weak and I just can't get it to connect correctly.

see error:
System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure............
0
pyrosdav
Asked:
pyrosdav
  • 4
  • 4
  • 2
  • +1
1 Solution
 
Paul MacDonaldDirector, Information SystemsCommented:
It's unclear to me what the connection path is here.  Also unclear is who issued the certificate, and to whom it was issued.

If I understand correctly the path is ...
     client -> https connection -> external server -> web service connection -> internal server
...and you're trying to make the connection secure by taking a certificate issued to the internal server, and installing it on the external server - is that right?
0
 
Aaron TomoskyTechnology ConsultantCommented:
when you install the cert, you have to add it to the ROOT store, not the default "put it whereever I think it should go"
0
 
pyrosdavAuthor Commented:
Currently  we are trying to get the connection directly from the external web server to the internal web server via 443 before we open up access to the customers on the outside world.

I am remoted in to the external web server and trying to hit the localhost webpage on the external server : https://localhost/carrierhub/Login/Login.aspx?ReturnUrl=%2fCarrierHub%2fStandardApps%2fUserProfile.aspx

This prompts a certificate warning and the option to continue (not recommended)

I continue logging in with the admin acct and can get to the webpage, but i get back an error message when the webpage is trying to pull the data from the internal web server.

I tried to click on the mismatch certificate error on that page to get rid of the first certificate warning and install it to Trusted Root Certification Authorites. it installed, but I continue to get prompted for the certificate warning.

The main page shows the original error i posted, but anywhere i try to click on the webpage i get "The remote certificate is invalid according to the validation procedure. " The stack trace shows the 2 main exceptions:

AuthenticationException: The remote certificate is invalid according to the validation procedure.]................

[WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.].....................
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
Aaron TomoskyTechnology ConsultantCommented:
I'm not a cert expert by any means, but usually when I see that sort of thing, it's because the cert isn't chained up to a root authority. I'll let someone else get into it deeper, but I'm pretty sure you are on the right track.
0
 
CoralonCommented:
Try putting the cert in the Machine store as a Trusted Person.  You avoid the need for the chain of trust for that cert.  

it's not the perfect solution, but it is a good test.  If it is, then you need to put the entire chain in the machine store.  You'll have the root cert, one (or more) possible intermediate chain cert(s), and then the cert itself.  When you look at the certification path, all steps should show as Ok.

Coralon
0
 
pyrosdavAuthor Commented:
I have tried placing it everywhere. For some reason the website that i connect to says "https://server-5/CarrierHub-WebServices/WebServices.asmx" but the certificate comes over as "WMSvc-server-5. I have checked the certificate store in IIS7 on server-5 and i can't seem to find where this certificate is located on server-5. no matter what i do, i just can't get the site to not warn me.

This is causing some type of ssl trusted error so the data will not transmit and our firewall team will not open port 80 to simply solve this issue.
0
 
CoralonCommented:
Ok, you need to attach that cert on server-5 to the correct website.  Put it in the trusted certs on that machine, and then go into IIS, and bind that cert to the site.

Coralon
0
 
pyrosdavAuthor Commented:
I see where to create self-signed certificates, but I am failing to see where in II7 to attach it to the correct website under the Default web Site. There are a couple and I do not want to break the other sites that are not using https yet
0
 
CoralonCommented:
You put the certificates in as local trusted certs.  That is not IIS itself.
Once you get into IIS, you will create a binding for your site using the SSL cert.  The key is that when a site is bound with SSL, you cannot use any other sites with it.  Your combination of IP address & port must be unique for SSL.

Example:
10.0.0.1   Site1 443
10.0.0.2   Site2 443
10.0.0.1   Site3 444
10.0.0.2   Site4 444

If you *only* have a Default website, then you can only have 1 SSL site for them, assuming that you have 1 IP Address, and you want it on 443.  You can either bind more IP addresses, or more TCP ports, but you will require separate websites, not merely subsites.

Coralon
0
 
pyrosdavAuthor Commented:
Due to lack of experience, we did finally get this working.
We setup new external IP addresses and internal IP addresses and restricted access over 443 between the external web server and internal web server.
They created a self generated certificate and bound it to each internal IP on the internal web server. The largest issue was getting the vendor of the application to understand what we were trying to accomplish and change the config files on the IIS internal and external to communicate correctly. Once we completed that, it worked. Now customers will hit a new external IP and the web server queries the internal web\appl server database server which then queries the SQL server for the requested info. Secure on the outside https, https communication between the external web and internal web servers is done.

Sorry it took so long to complete this, i had forgotten about the case. Thanks for your guidance.
0
 
CoralonCommented:
You're welcome, and I'm glad you got it working :-)

Coralon
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 4
  • 4
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now