4

I'm having a problem where the security certificate for a site is being periodically unbound from port 443 and replaced with another certificate which is sitting on the server. So whenever a user tries to access the site they are met with a 'untrusted' warning.

So when this first happened, I investigated and found the wrong certificate in place so I changed it back. This worked fine for a while but then it happened again. I checked the event logs and the following two warnings are fired:

SSL Certificate Settings deleted for endpoint : 0.0.0.0:443

SSL Certificate Settings created by an admin process for endpoint : 0.0.0.0:443

This happens once or twice a day, and I have to keep rebinding the correct certificate, and I haven't been able to find a solution yet.

The site is running on Windows Server 2012/ IIS 8

According to a couple of online support forums/articles there was an old legacy setting in the ApplicationHost.config file which was supposed to cause this. All references to this that I found referred to a property in the 'customMetaData' section, the property had a specific Id (5506). I couldn't find this specific property anywhere in our ApplicationHost.config file on the server.

Has anyone encountered a similar issue? Or can anyone shed any light on potential causes of this? Having looked around online I'm finding it hard to find much related to my problem, but perhaps I'm not searching for the right thing...

Any advice on this issue would be greatly appreciated.

1 Answer 1

1

I struggled with exactly this issue on an AWS instance. It seemed like every 5 minutes, I had to go into the bindings and re-select the SSL Cert. So, I decided to save myself some time by creating a batch-file that sets the SSL cert from the command-line. I ran the batch-file once, and then left it on the desktop, with the intention of double-clicking it every time I had this issue.

The problem never happened again.

My thoroughly scientific conclusion is that setting the SSL Cert from the command-line worked more betterer than setting it from the GUI. Here's the command I used:

netsh http add sslcert ipport=0.0.0.0:443 appid={some-guid} certhash=MyCertThumbrint

I used an Online GUID Generator to generate an appid.

Here's an article that tells you where to find your cert's thumbprint.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .