Security Certificate error

Posted on 2016-08-19
Last Modified: 2016-08-22
I don't know much about certificate errors.  I have an internal App Server that when people go the the internal address (only option anyway)
it gives errors about an untrusted site.  How can i tell what security certificate the app/website is using on the server and whats the easiest way to get by this.  Unless there is something i am unaware of.... im not really concerned about security certificates on this web server because it is on our lan and not in the dmz.

Windows Server 2012
IIS Version 8.5.9600.16384
Question by:jamesmetcalf74
  • 3
  • 2
LVL 29

Expert Comment

by:Rich Weissler
ID: 41763073
I usually click on the lock in the brower on the address line.  What you do next to look at the certificate depends on the browser.  (It'll frequently let you know WHY something is untrusted.  Candidates include: Certificate not signed by a trusted root; Certificate expired; Certificate signed with a SHA1 signature, etc.)

From the server, you'll want to bring up the IIS Manager, and drill down to the webpage.  Right click, and select 'bindings', and select the https line.  It'll display the certificate it's using by it's friendly name.  (And to see which certificates are available on the server, close the bindings page, and select the server itself.  In the features view, under Security, you'll have an icon for 'Server Certificates'... selecting that will show you the certificates available to IIS in the certificate store.

Author Comment

ID: 41763076
Thanks Rich.
so i looked at the edit bindings for the default website (its the only website)  and there is only one for http.  there isn't one for https://
i also noticed a warning in the top right that says.  This site does not have a secure binding (HTTPS) and cannot accept SSL connections.

any more input from here?

Author Comment

ID: 41763094
so i have tried to add a binding for https to the default website.  there are some certificates that are available for me to choose from.  One that doesn't expire until 2040.  I select it and add the binding....
and it says.  this binding is already being used. If you continue etc....... do you want to use this binding anyway.  I don't see anything that indicates this binding is already being used in the bindings interface.  anybody know what gives?
LVL 29

Accepted Solution

Rich Weissler earned 500 total points
ID: 41763099
Depending on the application... whether it's written to work with SSL, etc... you should be able to add a binding for https.  You'll need to make certain you have a certificate available before you can do that though... and the easiest way will be back on the 'Server Certificates' feature on the server itself.  From there, you have three relatively easy options:
  1. If you don't mind a self-signed certificate (basically untrusted by everyone.. but will provide encryption) -- you'll select 'Create Self-Signed Certificate...' from the Actions.
  2. If you have a Windows Certificate Authority (ADCS) in your environment, you'll select 'create domain certificate...' from the Actions.  (It'll use the Web Server template... and I still haven't found a way to change that from the tool in IIS.)
  3. If you need a trusted public certificate (and it doesn't sound like you do from your description), you can 'create a certificate request...' from Actions.  At that point you'll need to purchase a certificate from a public certificate authority (which can vary from free to several hundred dollars per year.)  The second part of that, 'Complete Certificate Request...' is the action you take when you get the signed certificate back from the certificate authority.

Once you have a usable certificate on the server, you can use that in the bindings on the site.  (And at that point, we have to hope the website author didn't do silly things like embed 'http' in their website.)
LVL 29

Expert Comment

by:Rich Weissler
ID: 41763104
> binding already used...
Aha!  Do you have another website on that server that maybe has https: already bound on port 443?  If so, you have a little bit of a problem... in that only one certificate can be bound on a port on the server at a time.  :-(  (And if you do select okay at that point, you'll likely break the OTHER website, 'cause now it may have a certificate that doesn't correspond to THAT site.)

On the other hand, if you find which certificate that other website uses... you should be able to use that same certificate on the binding for this website.  (And at that point, you may get a certificate mismatch error on your website, but traffic can still be encrypted.)

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Join & Write a Comment

Suggested Solutions

Debug Tools to analyse IIS process: This article focus on taking memory dumps from IIS to determine which code is taking more time and to analyse which calls hangs/causes more CPU usage. To take dumps,download the following. Install1: To st…
When it comes to showing a 404 error page to your visitors, you do not want that generic page to show, and you especially do not want your hosting provider’s ad error page to show either. In this article, I will show you how to enable the custom 40…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now