Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Alright, I setup a simple Windows 2012 R2 RDs server aio farm with Web Access, everything works fine internally if I access the server directly (https: // rdsiisserver/RDWeb/). I created a Ubuntu HAProxy (https: // haproxy-server) and have it forwarding https directly to the RDS IIS server. It works too, the main IIS front page is loaded, but I can not access the Web Access page (".../RDWeb/"). I get the following error in chrome if I try to access RDWeb:

This webpage has a redirect loop

IE displays the following error:

There is a problem with this website's security certificate. We recommend that you close this webpage and do not continue to this website.

Click here to close this webpage.  
Continue to this website (not recommended).

I press "Continue", and the page fails with "Internet Explorer cannot display the webpage".

There is a CA certificate on the RDS IIS server, everything was secure and works perfectly if I access the RDWeb IIS server directly. When I added the haproxy I exported the pfx certificate and I had to convert it to pem with openssl on the ubuntu haproxy server:

openssl pkcs12 -in cert.pfx -out cert.pem -nodes

I imported the GoDaddy certificate and added it to my haproxy cfg. It seems to work, as I can access the rds iis main webpage securely with https... but not RDWeb sub page.

Question is, is it the certificate? I understand the GoDaddy certs can be problematic and I have tried converting the cert several ways but the above conversion was the only one that actually worked for me without HAProxy failing to start.

Do i need the same certificate on both servers? I would like to use https internally and externally.

share|improve this question
1  
To debug SSL issues, use openssl s_client -connect <addr>:<port> and compare the results. The same certificate should be presented from all locations. - Note that the SSL handshake will also fail if the cert is correct, but you don't reach the site through the CN or a SAN. –  Felix Frank Aug 15 '14 at 13:12
    
"This webpage has a redirect loop". I think this is totally unrelated to the certificate itself. –  Daniel Aug 18 '14 at 19:51
    
Out of curiousity, what is the exact error message in Internet Explorer, regarding the certificate? Click on the certificate button next to the web address bar. –  Daniel Aug 18 '14 at 19:52
    
I agree with Daniel; the redirect is almost certainly not caused by your certificate issue. You should post your haproxy config for further help with that. –  briantist Aug 24 '14 at 3:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.