Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to connect a Windows Vista client to a Lanier LD445c (scanner/copier/printer) using IPP over SSL/TLS in order to provide an encrypted channel for printing. The LD445c that I setup for testing is using a self-signed certificate and I'm using the drivers straight from the manufacturer.

Windows XP clients work fine when I set up the printer using https, but when I attempt with Vista Enterprise client it flat out refuses to map the printer. I've done packet captures that show that the client makes a succesful connection to the printer, but after a brief exchange of packets the client sends a RST.

  • Does Windows Vista support IPP over SSL/TLS?
  • If so, is there a straightforward guide that explains how to get it set up?.
  • If not, what options of encrypting print jobs do I have?
share|improve this question

1 Answer 1

up vote 1 down vote accepted

Here's a nice blog entry describing the tribulations associated with getting IPP over SSL to work from an MSFT employee: http://blogs.msdn.com/spatdsg/archive/2007/08/08/-Putting-CAPI2-logging-to-good-use.aspx

Basically, XP didn't care about a self-signed cert on IPP resources being accessed with HTTPS, but Vista does. Surprise, surprise.

You have 3 choices:

  • Install the CA certificate used to sign the printer's cert onto your client(s) (can be published via AD - see http://technet.microsoft.com/en-us/library/cc738131(WS.10).aspx).

  • Use your own enterprise CA that your clients already trust to sign the certificate for the printer (if you have one)

  • Get a certificate from a third-party CA that the clients already trust for the printer (which seems like an expensive and bad idea)

That blog post goes thru generating a self-signed cert on a client computer. I don't have any Lanier documentatation, but presumably there's somewhere in the web interface that you could upload a certificate and a private key.

share|improve this answer
    
So is mine, I've already tried importing the self-signed cert. Going to try a real cert and see what what happens. –  Bob Jul 24 '09 at 19:24
    
@Bob: I dropped an edit on here that has a link to a blog entry w/ more details. Have a look. –  Evan Anderson Jul 24 '09 at 19:30
    
Your google-fu is strong. So it's hates my self-signed cert because the CN's don't match. good ol' Vista, protecting me from myself. I love that CAPI2 event log as well. –  Bob Jul 24 '09 at 19:56
    
Thanks Evan! As always you ability to speedily answer every concievable question is mind boggling :-) –  Bob Jul 24 '09 at 19:58
    
My gut was just screaming "self-signed cert... Vista HATES self-signed certs" as I read the question. Glad that I was able to home-in on the answer for you. (I'm working on being the Jon Skeet of Server Fault, eh?) –  Evan Anderson Jul 24 '09 at 20:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.