Security Certificate error

Posted on 2016-08-19
Last Modified: 2016-08-22
I don't know much about certificate errors.  I have an internal App Server that when people go the the internal address (only option anyway)
it gives errors about an untrusted site.  How can i tell what security certificate the app/website is using on the server and whats the easiest way to get by this.  Unless there is something i am unaware of.... im not really concerned about security certificates on this web server because it is on our lan and not in the dmz.

Windows Server 2012
IIS Version 8.5.9600.16384
Question by:jamesmetcalf74
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
LVL 30

Expert Comment

by:Rich Weissler
ID: 41763073
I usually click on the lock in the brower on the address line.  What you do next to look at the certificate depends on the browser.  (It'll frequently let you know WHY something is untrusted.  Candidates include: Certificate not signed by a trusted root; Certificate expired; Certificate signed with a SHA1 signature, etc.)

From the server, you'll want to bring up the IIS Manager, and drill down to the webpage.  Right click, and select 'bindings', and select the https line.  It'll display the certificate it's using by it's friendly name.  (And to see which certificates are available on the server, close the bindings page, and select the server itself.  In the features view, under Security, you'll have an icon for 'Server Certificates'... selecting that will show you the certificates available to IIS in the certificate store.

Author Comment

ID: 41763076
Thanks Rich.
so i looked at the edit bindings for the default website (its the only website)  and there is only one for http.  there isn't one for https://
i also noticed a warning in the top right that says.  This site does not have a secure binding (HTTPS) and cannot accept SSL connections.

any more input from here?

Author Comment

ID: 41763094
so i have tried to add a binding for https to the default website.  there are some certificates that are available for me to choose from.  One that doesn't expire until 2040.  I select it and add the binding....
and it says.  this binding is already being used. If you continue etc....... do you want to use this binding anyway.  I don't see anything that indicates this binding is already being used in the bindings interface.  anybody know what gives?
LVL 30

Accepted Solution

Rich Weissler earned 500 total points
ID: 41763099
Depending on the application... whether it's written to work with SSL, etc... you should be able to add a binding for https.  You'll need to make certain you have a certificate available before you can do that though... and the easiest way will be back on the 'Server Certificates' feature on the server itself.  From there, you have three relatively easy options:
  1. If you don't mind a self-signed certificate (basically untrusted by everyone.. but will provide encryption) -- you'll select 'Create Self-Signed Certificate...' from the Actions.
  2. If you have a Windows Certificate Authority (ADCS) in your environment, you'll select 'create domain certificate...' from the Actions.  (It'll use the Web Server template... and I still haven't found a way to change that from the tool in IIS.)
  3. If you need a trusted public certificate (and it doesn't sound like you do from your description), you can 'create a certificate request...' from Actions.  At that point you'll need to purchase a certificate from a public certificate authority (which can vary from free to several hundred dollars per year.)  The second part of that, 'Complete Certificate Request...' is the action you take when you get the signed certificate back from the certificate authority.

Once you have a usable certificate on the server, you can use that in the bindings on the site.  (And at that point, we have to hope the website author didn't do silly things like embed 'http' in their website.)
LVL 30

Expert Comment

by:Rich Weissler
ID: 41763104
> binding already used...
Aha!  Do you have another website on that server that maybe has https: already bound on port 443?  If so, you have a little bit of a problem... in that only one certificate can be bound on a port on the server at a time.  :-(  (And if you do select okay at that point, you'll likely break the OTHER website, 'cause now it may have a certificate that doesn't correspond to THAT site.)

On the other hand, if you find which certificate that other website uses... you should be able to use that same certificate on the binding for this website.  (And at that point, you may get a certificate mismatch error on your website, but traffic can still be encrypted.)

Featured Post

U.S. Department of Agriculture and Acronis Access

With the new era of mobile computing, smartphones and tablets, wireless communications and cloud services, the USDA sought to take advantage of a mobilized workforce and the blurring lines between personal and corporate computing resources.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Logparser is the smartest tool I have ever used in parsing IIS log files and there are many interesting things I wanted to share with everyone one of the  real-world  scenario from my current project. Let's get started with  scenario - How do w…
Preparing an email is something we should all take special care with – especially when the email is for somebody you may not know very well. The pressures of everyday working life stacked with a hectic office environment can make this a real challen…
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
Monitoring a network: how to monitor network services and why? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the philosophy behind service monitoring and why a handshake validation is critical in network monitoring. Software utilized …

691 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question