Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Hot answers tagged

22

I ran into the same issue with a GoDaddy SSL certificate on Windows 2012 / IIS 8. What worked in my case, after getting the "Failed to Remove Certificate" error, was this: I have tried adding it again, this time getting an "Access Denied" error. I have also tried adding it to the "Personal" store instead of "Web Hosting" but same "Access Denied" error ...


16

A redirect from http://old.example.com to https://new.example.com does not require a certificate for old.example.com. But a redirect from https://old.example.com to https://new.example.com does. If people's bookmarks or search engine search results or other external links point to the https site, you better renew the cert. If you merely assume that people ...


15

Yes, you will need a new certificate if the redirection is done in a HTTP response (a 301 or 302 return code). If you don't the redirect will not work, visitors of the old domain will get an error the certificate expired if they visit the old domain via HTTPS.


12

Configuration Editor within IIS Manager does exactly this. Creates a script of the actions that you have recently performed. Opens the Script Dialog window that displays the script for your action in three programming languages: C#, JavaScript, and AppCmd. The generate script functionality is only enabled after you take an action, such as changing the ...


12

Got it (Make sure you are using CMD ADMIN and Powershell ADMIN) Using CMD, it will not work in powershell not sure why it doesn't. msdeploy -verb:sync -source:webserver,computerName=acd-pv01 -dest:webserver,computerName=acd-pv02 -skip:skipAction=Delete,objectName=binding -skip:skipAction=AddChild,objectName=binding A little overview There are a couple ...


9

No, IIS is a integrated part of the OS and can't be separately upgraded to a newer version. HTTP/2 especially isn't implemented in IIS, but in a kernel mode driver that is naturally only available in Win 10/2016. Note: IIS 10 Express exists (and can be installed on that OS), but this is a testing/development server not meant for production use.


8

You need to determine the reason for the 500 error. It's usual to look in your logs for more detail and work out from there. You should also take a look at the excellent answer to this Q&A which gives sound advice on diagnosing issues.


8

Save certificate and key files with identical names in the same folder (cert.cer and cert.key, for example) and use certutil: certutil -mergepfx cert.cer cert.pfx and enter PFX password.


7

If the IP Security under IIS Windows Features is installed you could add this to your web.config to block IP's: <location path="Default Web Site"> <system.webServer> <security> <ipSecurity allowUnlisted="false"><!-- this line blocks everybody, except those listed below --> <clear/...


7

I believe this has been covered in several places, but the Balanced power plan can cause excessive transitions between performance states. This results in exceptionally poor performance, and affects both physicals and virtuals. Change the power plan to High Performance to use the hardware to its limits. Slow Performance on Windows Server 2008 R2 when ...


7

It is not IIS fault. Looks like you downloaded wrong intermediate CA certificate or incorrectly merged certificates with OpenSSL. IIS internally builds certificate chain and uses these certificates (except root certificate, which is not transmitted during SSL handshake) to send to client. Even if the certificate is not presented in the store, IIS can use ...


6

Interesting question. All the methods to remove response headers from IIS don't seem to work for the Allow and Public headers, an OPTIONS request always returns: Allow: OPTIONS, TRACE, GET, HEAD, POST Public: OPTIONS, TRACE, GET, HEAD, POST regardless what the server actually allows. All requests in IIS are handled by modules, the OPTIONS requests are ...


5

A quick review of the site in question solved this question. It was setup with IP Address Restrictions, the 404.503 is logged for every request that is not from an allowed IP address. Normally a 403 (Forbidden) status is sent, but in IIS 7+ you can specify which status to return. In the 'Edit Feature Settings' for IP restrictions choose the 'Deny Action ...


5

I ran into a Similar Issue. I had to download the certificate as a .P7B file, Install the Certificate into the local Cert Store, then Export the Certificate as a .PFX with a Password. Right Click the Cert and Click Install, You can choose Automatic, or the 'The Following Store' I believe Automatic installs it into Local Computer/Personal. So in MMC, load ...


5

The problem is, you need to install the IIS feature Application Initialization. Then it should work with your configuration. The image is from Rick Strahl's blog: Also remember to set: Start Mode to AlwaysRunning on the application pool Preload Enabled to True on the website level You can set this settings without the Application Initialization Module be ...


5

You have two main options: Pre-bake your application and configuration into an AMI, which the ASG uses to launch new instances. Use the user-data launch configuration field to have the instance itself download your application and configure it as part of the boot process. I generally prefer #1 as it gets the instance up and running faster. #2 is more ...


5

We added registry keys to force the .NET app pool over to TLS 1.2. This was to allow an app to talk to Salesforce after SF issued a critical update disabling TLS 1.0. The registry keys apply to the whole server as opposed to a single site, unfortunately. The build broke for the reason you indicate above. This worked for us: Getting WebDeploy working after ...


5

I was working on the same problem. This script will update your apphost config to create both the FastCGI process pool and the handler mapping. import-module WebAdministration ############################################################### # Adds a FastCGI process pool in IIS ############################################################### $php = 'C:\php\...


4

This issue seems to have fixed itself through the course of working on the project. Andrew Morton provided some excellent trouble shooting steps for anyone else having similar issues. I'll provide quick list: Verify the correct MIME type is being used by the server. Using IIS Manager > Server > Project > MIME Types. Here are the list of MIME types that are ...


4

There may be some misunderstanding on which session is concerned. You have the session most web applications use to create persistence between multiple HTTP requests, the stereotypical contents of your shopping cart. That is not what SSLLabs is testing. Regardless: when using a load-balancer you should typically replicate that session state so your visitor ...


4

After enabling TLS 1.2 (also 1.0 and 1.2) on Windows 2012 R2 and 2008 R2 SP1, process lsass.exe began to overload CPU. I used the IISCrypto40, click "Best Practices", and in "Key Exchanges Enabled" left enabled only PKCS. After it, the load on the cpu returned to normal (5 - 10%). p.s. sorry for the poor english IISCrypto preferences


4

It seems you are using Passive mode. Passive mode uses TCP ports from 1024 to 65534 for Data channel. Make sure no Firewall is blocking this port range. Else, switch to active mode to only use TCP/20 for Data channel. EDIT : Also, FTPS can operate in two distinct mode : implicit or explicit. Explicit will use standards ports (for Active mode) : TCP/21 &...


4

Have you tried with just a dot? <mimeMap fileExtension="." mimeType="application/octet-stream" />


3

You do need to do that. When you create the certificate request, your computer automatically generates a mathematically related private key at the same time. This private key is associated to that exact certificate request. No one else has the private key except for the computer on which the request was generated. Those signed .crt files that you get back ...


3

I had the same issue. I fixed with openssl openssl pkcs12 -export -in my.crt -inkey my.key -certfile my.bundle -out my.pfx Than i imported to IIS 8.5


3

This error is generated because an absolute path is detected in web.config. Absolute physical path (like C:\path\to\notfound.html) is not allowed in system.webServer/httpErrors section in web.config file. Now you have 2 solutions : 1. Allow physical path in ApplicationHost.config file By default this file is located in %SystemRoot%\system32\inetsrv\...


3

For Linux servers I manage these attempts using fail2ban so that it will autoban the IPs that attempt to find vulnerabilities on the web server. IIS has some free plugins (Microsoft supported) that do the same thing. These tools allow you to restricts the types of HTTP requests that IIS will process and/or temporarily ban the IPs that make those requests. ...


3

If you look at the default permission for C:\inetpub\wwwroot: BUILTIN\IIS_IUSRS:(RX) BUILTIN\IIS_IUSRS:(OI)(CI)(IO)(GR,GE) NT SERVICE\TrustedInstaller:(I)(F) NT SERVICE\TrustedInstaller:(I)(OI)(CI)(IO)(F) NT AUTHORITY\SYSTEM:(I)(F) NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F) BUILTIN\Administrators:(I)(F) BUILTIN\Administrators:(I)(OI)(CI)(IO)(F) BUILTIN\Users:(I)...


3

You need to set the external IP of your server to have passive mode work. In IIS: (step 5 for passive mode, other are for active mode) How to configure the global firewall settings for the FTP service 1.Open Internet Information Services (IIS) Manager: •If you are using Windows Server 2012 or Windows Server 2012 R2: •On the taskbar, ...


3

I've just gone through this issue on my server. This was on 2008R2. Ensure all certs are using the new intermediate certificate as we're going to remove the old one Remove X1 intermediate cert from the local computer and all local user accounts Remove the secure binding in IIS for each certificate Re-add each of the secure bindings in IIS There maybe some ...


Only top voted, non community-wiki answers of a minimum length are eligible