0

I have this Windows Server 2016 where a windows third-party Windows service is listening to a specific port that is in turn associated with a specific SSL certificate. At first, the SSL certificate was issued for the wrong CN (internal IP rather than external) so there was a certificate error when browsing the services URL. When re-registering (remove, then add again) with a correctly generated certificate, however, to my surprise, the error did not go away.

Bewildered, I ended up doing other things for a couple of hours, and upon return I was even more surprised to see that now there were no errors anymore. I don't understand this behavior, and I'm hoping you can shed some light on it. What's going on here, why didn't my changes take effect immediately?

(All manipulation of the ports was done using netsh, and the certificate chain was always OK. I did restart my browser and the service in question.)

Improve this question
6
  • The behavior will entirely depend on your "third-party Windows service". The way it handles incoming connections, does TLS handshakes, manages certificates is entirely up to the implementation of this specific service. If you are able to reproduce the behavior, you might go and ask the manufacturer. For what it's worth, if it is not giving you too much of a headache right now, just leave it alone.
    – the-wabbit
    Aug 18, 2017 at 13:49
  • How is that? I thought the registration of a SSL certificate to a specific http port (e.g. netsh http add sslcert ipport=0.0.0.0:8000 [...]) was unrelated to whatever implementation of whatever is actually listening to that same port. I did talk to the manufacturer of the service, and they could not explain this behavior.
    – Oskar Lindberg
    Aug 18, 2017 at 14:08
  • Is your service using HTTP.sys / the HTTP server API? The netsh registration would not affect anything but HTTP.sys - managed connections...
    – the-wabbit
    Aug 18, 2017 at 14:27
  • Then, by necessity I suppose - since it's working now - that it must be using HTTP.sys managed connections. Thanks, by the by, for taking an interest in the question - I'm sure it all seems trivial to you, but to me it's off the map.
    – Oskar Lindberg
    Aug 18, 2017 at 15:13
  • In this case, it is indeed strange. http delete sslcert and http add sslcert should be effective immediately. Do you have some more detail about the third-party service you mentioned? It might well be that it is doing strange things (like not using HTTP.sys directly but just reading its configuration periodically). Care to check out if your service is still responding after you did net stop http?
    – the-wabbit
    Aug 21, 2017 at 7:56

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .