0

Possible Duplicate:
Configuring IIS site to use HTTPS

I am developing a REST API which I want to secure with SSL/TLS. I have implemented a large part of the API which I have tested over HTTP, however, I am now at the stage where I want to switch it over to use HTTPS.

At the moment the API is hosted on a Windows XP professional SP2 box running IIS 5.1 (development environment only) and I used the SelfSSL.exe tool from the IIS 6.0 Resource Kit Tools to generate a server certificate. I then configured my API to use this certificate which all appeared to work fine as I attempted to connect to my API using HTTP and I get a 403 response saying "... must be accessed over a secure channel...". However, the problem is when I then attempt to access the API over HTTPS it just appears to hang!

As this is a development environment at the moment I don't have a domain name (just a static IP address) and the API is running on port 81. Also (incase it matters) the API is the default site (I replaced it).

Any ideas why I can't connect using HTTPS?

Improve this question
3
  • What program are you using to connect to the server?
    – DerfK
    Jul 7, 2012 at 12:00
  • Fiddler just now, the actual client itself will be a mobile app. Also for clarification I have enabled the "ignore client certificates" option in IIS so the client shouldn't need a valid/recognised cert for it to work.
    – James
    Jul 7, 2012 at 12:13
  • Care to comment on the downvote.. downvoter?
    – James
    Jul 7, 2012 at 14:29

1 Answer 1

Reset to default
2

Is port 81 HTTP or HTTPS? You can't run both on the same port, so if you're hitting http://192.0.2.69:81/, getting the 403, and then trying again on https://192.0.2.69:81/, it's little wonder you're seeing problems.

Improve this answer
17
  • The site is setup for HTTP (enabled the requires SSL option). I was just verifying that it was setup for SSL only by attempting to access it via HTTP, the 403 confirms that does it not?
    – James
    Jul 7, 2012 at 12:46
  • The 403 confirms that it wants to be accessed via HTTPS, sure, but you said in your question "when I attempt to access the same resource over HTTPS it just appears to hang!", which is what I thought you wanted help with. Perhaps you need to understand your problem better before you ask other people to help you with it?
    – womble ♦
    Jul 7, 2012 at 12:48
  • are you sure you just didn't misread my question? I understand my problem which is why I have posted a question.... I am trying to secure an API using TLS with a self signed certificate but when I attempt to access it via HTTPS it hangs.. I was merely giving some background information of what I have already tried.
    – James
    Jul 7, 2012 at 13:02
  • @James What he's asking is whether you're trying to use :81 for both HTTP and HTTPS, which can't be done. Getting a 403 when you try to connect with HTTP means that the server is speaking HTTP, not HTTPS.
    – DerfK
    Jul 7, 2012 at 13:58
  • @DerfK My question clearly state I am now at the stage where I want to switch it over to use HTTPS, I understand you can't do both on the same port. It's not just any 403 response, it specifically tells me The page must be viewed over a secure channel which I assumed meant it was only running HTTPS? Like I said in my question, I have generated a self-signed cert, configured my API to use it (enabled Requires secure channel option in IIS) but whenever I try to access any URL via HTTPS it just appears to hang.
    – James
    Jul 7, 2012 at 14:05

Not the answer you're looking for? Browse other questions tagged .