Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Hot answers tagged

9

You can use single public certificate for both, external and internal clients. There is no need to use separate certificate for internal clients. Keep things simple.


5

Sure. You need one IP address per Certificate. SNI is there for a reason and I would slap the idiot if provider around who does not support SNI in the year 2018. Heck, it was standard in 2010 or so. MS was late to the party server wise, IIRC.


5

The NTFS/SMB permissions for shared IIS storage are detailed described in ms guide: https://docs.microsoft.com/en-us/iis/web-hosting/configuring-servers-in-the-windows-web-platform/configuring-share-and-ntfs-permissions If you have some webapp/scripts, which should write data in folder on file server, then you should configure appropriate permissions for ...


4

If you want to use multiple websites on the same host with different certificates, you need SNI, Server Name Indication, from the client. Modern clients should support this. You also need to enable it on the server. Microsoft has instructions how to do this. Basically, you have to specify the host name and check the box "Require Server Name Indication", in ...


4

Regarding attacks against the server it is no less secure having port 80 open for HTTP than having port 443 open for HTTPS. If there is a bug at the server side of the provided web application (i.e. SQL injection or similar) it can be exploited no matter if HTTP or HTTPS. The relevant difference between HTTP and HTTPS is that HTTPS protects the transport of ...


3

Had the same question as the original poster but could not find a concise answer, below is the analysis from my research. Application Pool != Worker Process (w3wp.exe) Typically we see a single w3wp.exe instance running for each application pool but technically we can configure a web garden with multiple w3wp.exe instances running. Web gardens... are they ...


3

In order to be added to the certificate authority list in Firefox a certificate must have X509v3 extension CA:TRUE, e.g. X509v3 extensions: X509v3 Key Usage: critical Certificate Sign, CRL Sign X509v3 Basic Constraints: critical CA:TRUE This would be the case if you had your own private CA certificate used for ...


3

Windows has it's own tool for creating certificate requests. You can use the rather clumsy certreq or the much easier Management Console (Add Certificates plugin for the Computer account on Server 2008R2 and earlier, or run certlm.msc on Server 2012 and later). In addition to the certificate returned from the CA, you also need the private key installed on ...


3

You can't use different certificates for the same website (*). Use a public certificate, internal clients will trust it just fine. (*) There are workarounds, but they are quite cumberstome and you shouldn't use them unless absolutely required.


2

The administration tool does not behave consistently enough to allow you to order the bindings. The reason for this, I think, is that your bindings are supposed to be unambiguous enough to not require ordering. Note that under the covers, the web admin MMC (and Microsoft.Web.Administration API) are managing settings both in the IIS server config file, and ...


2

My IIS servers are behind an F5 load balancer which was causing this. I had the Data Center manage all redirection from http to https on their end.


2

This is solved by installing updates, apparently there was some issue with one of the recent Windows updates: https://support.microsoft.com/en-us/help/4345424/improvements-and-fixes-windows-8-1-and-server-2012-r2


2

If your load balancer is taking the SSL offload then it will be the device that terminates the SSL connection and performs the handshake. You'll need to make sure the load balancer has the correct certificate.


2

Have you looked to see what the configuration of the old SMTP server is? Maybe it's relaying through a smarthost? Anyway, SPF and DKIM only apply to the immediate connection. So if your Blat server connects to a local mail relay app, which then sends to your Exchange server, which then handles final delivery, then it's only that last hop (Exchange to final) ...


2

I'm assuming there is no other way than using http for your particular task, because I don't know what the purpose of these https requests is (otherwise it's nice to know that Windows 10 and Server 2016 finally have SSH support). I don't know which version of IIS/Windows you're using so I give you a general description: 1) Yes, and this is the reason: ...


2

Yes, you should add all names that are used for redirects. That is, if you connect to https://example.com and this site redirects to https://www.example.com and it is the same web site, then your certificate must include both, example.com and www.example.com in the Subject Alternative Names extension. If any redirect host part is not listed in the ...


2

You can go with option 1, two separate sites pointing to the same physical path. When you set forms authentication for the first site you get a web.config with: <configuration> <system.web> <authentication mode="Forms" /> </system.web> </configuration> If you choose Windows authentication on the second site you get:...


2

Yes you can, everything is in the IISAdministration Powershell module, using the Export-IISConfiguration cmdlet. You can visit this MS docs link to review what cmdlets best suit your specific needs. You can also use a couple of commands: To Export website: %windir%\system32\inetsrv\appcmd list site /config /xml > c:\sites.xml To Import the website: %...


2

You have accidentally configured client authentication on your IIS server. The server now expects your browser to send a certificate to the server in order to authenticate you. Start the IIS Management Console and with your site selected in the left-hand pane, open the SSL Settings page. You need to have Require SSL checked in order to enable SSL/TLS on ...


2

I have an explanation for this, you are attempting to achieve Single Sign On (SSO) using the negotiate / integrated windows authentication mechanism. This will not work with the Local Security Authority by itself. Negotiate attempts to first use Kerberos authentication, and falls back to NTLM if Kerberos is not configured. Kerberos is a windows ...


2

This did it remove-ItemProperty $pool -Name recycling.periodicrestart.schedule.collection


2

It seems you did not put the code in folder C:\inetpub\wwwroot. In case code is located in a folder different from this, you should give full control permission to the folder for user IIS_USRS. This is the user which IIS uses to service the content.


2

IIS does not "gracefully" close connections during a schedule shutdown. User sessions will be reset and if you're not managing the BIG-IP, sessions will still be sent to the downed server node until the BIG-IP virtual server monitor marks it as down and redistributes the traffic to other nodes. Mind you, most IIS monitors/service monitors will notice quickly ...


2

TL;DR The time up to the client's ack of the last TCP packet from the server's response is included in time-taken, so a slow client, say due to an unstable mobile connection, can increase time-taken arbitrarily, making your server look bad. Unless of course you know that time-taken is not the time the server took to fully process the request. I could ...


2

Is it the case that when any payload TCP packet is sent, a RST is sent back? Or does it specifically have to be a TLS / Client Hello? ie. if you type something after a telnet connection is established, does the connection then close/reset? Many years ago, I worked for a company that was developing technology employing similar mechanisms. From a private ...


2

Are we speaking outgoing mail only here? (Incoming mail comes with an altogether much more complicated set of issues to solve.) A TCP ("Layer 4") load balancer would solve your problem nicely. Perhaps, as @HBruijn mentioned, this may be possible using your existing SonicWalls. Otherwise my personally preferred tool is HAProxy (which does both Layer 7 and ...


1

I ended up with 2 viable solutions to this problem. Hopefully this will be helpful to anyone trying to setup something similar. Set up IIS with ARR (Application Request Routing) and enable Windows authentication globally. Then, configure a global authorization rule to allow whichever users you want to be able to authenticate through the reverse proxy. ...


1

Okay, so I got this sorted out. For anyone interested, read how it was done below: The website plugin required no SNI for this particular website and I needed SNI enabled, however, I also needed to set up a default SSL website. I went to the bindings for the website that i was having trouble with and added the following binding. The SSL certificate ...


1

My pet peeve, as an administrator you have access to the main apache configuration file and you should not rely on .htaccess files. Quoted from from the manual on .htaccess files: You should avoid using .htaccess files completely if you have access to httpd main server config file. Using .htaccess files slows down your Apache http server. Any directive ...


1

There is a brilliant tutorial at this website here If you follow this then you should be able to set up the redirect no problem! This will allow you to set up redirects for any site of your choosing.


Only top voted, non community-wiki answers of a minimum length are eligible