2

I wanted to ask what the proper procedure for installing an SSL certificate onto two servers running IIS6 that are in an NLB load balancing configuration.

Yesterday I installed the certificates according to what I believed to be the correct procedure. Shortly after this I was getting cert errors on my iphone (but nowhere else - chrome, IE, firefox were all fine)

Since then the site's SSL is not generating errors on my iphone either (Safari, chrome) but I don't feel confident that I've done this properly...

  • In IIS 6 request the certificate using the update option.

  • Use the resulting CSR to get the certificates (from godaddy)

Root Cert....

  • Using the acquired certificates, complete the pending request in IIS6.

  • Still in IIS6 export the cert.

  • On the other server - Import the cert into the 'Personal Certificates' store in the certificates snap in in MMC.

  • In IIS6 (still other server) choose the 'change certificate' option, and choose the newly imported certificate.

Intermediate cert...

  • Import the intermediate cert into the "Intermediate Certification Authority"

  • Here's where I'm unsure if I've done the right thing - I didn't export the imported intermediate certificate and then import it on the other server. Rather - I simply imported the same file again. I did this because I seem to remember learning in the past that the export-import did not need to be done for the Intermediate certificate. (Also, to this day I still don't fully understand what the purpose/point of the Intermediate certificate is. I believe it is provided to support very old browsers?)

So my question is - Have I done this right? Is this the valid procedure for updating SSL on load balanced servers running IIS6?

Edit: Upon further investigation (with the help of - https://www.ssllabs.com/ssltest/) I have discovered that the Intermediate certs weren't present on the first server (I could have swore I installed them but obviously I didn't) I have now installed them and my site passes the "Additional certificates" test for each server.

Improve this question

1 Answer 1

Reset to default
1

The intermediate cert does not need export/import, only import (it does not contain a private key)

You did everything right, as long as you have exported the cert on ServerA WITH the private key, and imported it to ServerB WITH the private key. But this seems to be the case as IIS accepted the certificate - all good.

Improve this answer
7
  • Thankyou for your answer. Frustratingly I saw the cert error turn up on my ipad a day later. It seems to show up maybe one time in 20. After taking the first server (the one originally generated the CSR on) out of the nlb cluster and reloaded the site on my ipad the cert error went away. I would have thought that if anything, the second server would be more likely to have the certs wrong than the first server.
    – MrVimes
    May 22, 2014 at 8:15
  • Ah, so you haven't set the new cert in IIS on the first server?
    – MichelZ
    May 22, 2014 at 8:33
  • I have set it (completed the signing request in iis) I tested the site inside the server - ssl ok, tested the site with one server out of nlb and the other in - ok on all browsers, swapped in nlb - ok in all browsers... then a day later the error shows up on my ipad... (but still ok everywhere else)... then it goes away on my ipad when I remove that server (still ok everywhere else)
    – MrVimes
    May 22, 2014 at 8:34
  • Completing the signing request does not assign it to the IIS website. •In IIS6 choose the 'change certificate' option, and choose the newly imported/created certificate.
    – MichelZ
    May 22, 2014 at 8:50
  • I completed the signing request from the website control dialog box, so it did assign it to the website. Anyway I have since discovered what is almost certainly the problem - Even though I was sure I installed the intermediates on the first server, it turns out I didn't (they weren't there) I will update my question with some details.
    – MrVimes
    May 22, 2014 at 10:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .