Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Windows 2008 Server with IIS7. Every time the server reboots, SSL stops working.

Normal HTTP requests work fine, but any request to an HTTPS address gives the typical error message in the browser:

Cannot find server or DNS

I can temporarily fix it by opening IIS Manager and bring up the Bindings… window for the website in question. Then I select “https”, click on “Edit” then click “Ok” without making any changes to the settings. After doing this, browsing to https:// works again until the next reboot.

This issue look as lot like the one described here, but according to the Certificates MMC snapin, the certificate in question does have a private key. I'm also pretty sure that I never installed the certificate in the personal store, but imported it straight into the machine store, but it's been a while...

There's not a lot in the event log apart from the event ID 36870 also described in the post I linked to.

Can anyone help me troubleshoot this issue so that SSL will work even after a server reboot?

share|improve this question
    
Hi Mark, I know that this is a really, really, old question now - but is there any chance you remember finding a solution to this problem and what it might be? We're experiencing the same thing as per: serverfault.com/questions/339323/…. –  Zac Dec 9 '11 at 10:09
    
No, sorry, I never found a solution... I have to go and manually fix the SSL configuration after each server reboot :( –  Mark Seemann Dec 9 '11 at 10:22
    
Ah, that's a pain. If I get a good answer on my post I'll try to remember to post it here as well. –  Zac Dec 9 '11 at 10:32
    
Well, we've found a solution for our problem - but we got it from the link you posted above so I guess it won't be able to help you. Good luck... –  Zac Dec 9 '11 at 12:32
    
Actually, this now leaves us in your situation - we will still have to do this every time we reboot... –  Zac Dec 9 '11 at 12:35

3 Answers 3

Something else that comes to mind would be a service that is trying to bind to your SSL port during startup. Do you have another SSL site or another server that's trying to listen on that port by any chance? If so, can you temporarily disable that server or switch the site to a different port to see if that allows your SSL site to come up?

share|improve this answer
    
Yes, that's a fair guess, but I don't think that's the issue. The problem only started after I changed the certificate. I'd been running for 2 years without incident with an older certificate, but it expired and I had to renew it. I also can't think which other service that would be. +1 for a good suggestion, though :) –  Mark Seemann Jun 10 '10 at 4:57

Does your certificate need/require any intermediate certificates that might not have been installed? There are plenty of sites that sell certificates now that are not root authorities, GoDaddy is a good example. In addition to your certificate you ahve to install their intermediate certificates for the chain of authority. Have you verified that you do not need these and/or they are installed if you do? Also, how is your current binding configured - do you have an IP specified and/or a hostname specified? If not have you tried specifying either one or both of those in your binding? That would really be more of a workaround than a resolution, but it could clarify if something like squillman stated was the case, and if it worked would also confirm your statement that your private key/certificate store are not corrupt.

share|improve this answer
    
The cert is issued by AD's Certificate Authority - just like the previous cert was. Note that it generally works - it's just that manual intervention is needed after each reboot. –  Mark Seemann Jun 10 '10 at 13:38

This was the solution for me:

http://blogs.msdn.com/b/asiatech/archive/2013/03/25/case-study-ssl-does-not-work-in-iis-7-5-after-server-reboots.aspx

Delete the certificate from the computer store and import it again. Don't drag and drop it from the user store.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.