SharePoint Geek » ssl http://sharepoint-geek.com SharePoint Tips & Tricks Tue, 24 Aug 2010 19:45:24 +0000 en hourly 1 http://wordpress.org/?v=3.0.1 Host Header On SSL Sites http://sharepoint-geek.com/2010/06/24/host-header-on-ssl-sites/ http://sharepoint-geek.com/2010/06/24/host-header-on-ssl-sites/#comments Thu, 24 Jun 2010 17:18:00 +0000 Stewart Schatz http://sharepoint-geek.com/2010/06/24/host-header-on-ssl-sites/ This is an update to our previous post (Enable Host Headers On An SSL/HTTPS Site). Which used the following command to enable host headers on SSL sites:

cscript.exe adsutil.vbs set /w3svc/<site-identifier>/SecureBindings ":443:<host header>"

I ran into some issues with using SecureBindings with the Central Administration sites so I thought I would post some of the other commands that I used:

To find out what bindings are on a site use the following command:

cscript.exe adsutil.vbs get w3svc/<site-identifier>/securebindings

To remove the host header from an SSL site use the following command:

cscript.exe adsutil.vbs set /w3svc/<site-identifier>/SecureBindings ":443:"
Tags: ,

Related posts

  • No related posts.
]]> http://sharepoint-geek.com/2010/06/24/host-header-on-ssl-sites/feed/ 0 IIS Admin Error: Handle Is Invalid – Permissions SSL Certificate MachineKeys http://sharepoint-geek.com/2010/05/05/iis-admin-error-handle-is-invalid-permissions-ssl-certificate-machinekeys/ http://sharepoint-geek.com/2010/05/05/iis-admin-error-handle-is-invalid-permissions-ssl-certificate-machinekeys/#comments Wed, 05 May 2010 18:32:18 +0000 Stewart Schatz http://sharepoint-geek.com/2010/05/05/iis-admin-error-handle-is-invalid-permissions-ssl-certificate-machinekeys/ Well, I’ve been trying to setup the External Collaboration Toolkit.  All of the instructions tell how to do it as a standalone install, but I am trying to get it setup in a farm.  One of the steps in the instructions is to setup ADAM to act as the authentication for external users.  The communications with ADAM need to be SSL encrypted.  So, I set it up the way the instructions say and went through the portion that ensures that the UserID that runs the ADAM service has access to the SSL Certificates. 

That’s when I must have went wrong.  Somehow, I removed access to the SSL Certificates from the service that runs the IIS Admin service.  So, when I rebooted, IIS would not start.  The only thing that was in the event log was:

Handle is invalid

Real helpful, huh?

Luckily, I was able to find Microsoft KB Article #278381.  The basic thing is that I needed to reset the security on the SSL Certificates.  Below is an explaination:

The MachineKeys are at the following location:
All Users Profile\Application Data\Microsoft\Crypto\RSA

The following settings are the default permissions for the MachineKeys folder:

Administrator (Full Control) This folder only
Everyone (Special) This folder, subfolders, and files
SYSTEM (Full Control) This folder, subfolders, and files 
 

To view the special permissions for the Everyone group, right-click the MachineKeys folder, click Advanced on the Security tab, and then click View/Edit. The permissions consist of the following permissions:

  1. List Folder/Read Data
  2. Read Attributes
  3. Read Extended Attributes
  4. Create Files/Write Data
  5. Create Folders/Append Data
  6. Write Attributes
  7. Write Extended Attributes
  8. Read Permissions

 

Select the Reset Permissions on all Child objects and enable propagation of inheritable permissions check box.

Tags: , , ,

Related posts

  • No related posts.
]]> http://sharepoint-geek.com/2010/05/05/iis-admin-error-handle-is-invalid-permissions-ssl-certificate-machinekeys/feed/ 0 Enable Host Headers On An SSL/HTTPS Site http://sharepoint-geek.com/2010/02/26/enable-host-headers-on-an-sslhttps-site/ http://sharepoint-geek.com/2010/02/26/enable-host-headers-on-an-sslhttps-site/#comments Fri, 26 Feb 2010 16:11:27 +0000 Stewart Schatz http://sharepoint-geek.com/2010/02/26/enable-host-headers-on-an-sslhttps-site/ The other day we came across an issue where a user inadvertently inserted a “https” in the URL of a site.  The resulting page that was displayed was the Central Administration site.

The only site that is secured with SSL on our servers is the Central Admin site.  The Central Admin site also has a host header.  So, I thought that all traffic on port 443 would require the correct host header for Central Admin to respond.

I was wrong.

I was able to find a script on Microsoft TechNet that will enable host headers for SSL sites.  Run the following from the commandline:

cscript.exe adsutil.vbs set /w3svc/<site identifier>/SecureBindings ":443:<host header>"

Where <host header> is the host header for the Web site and <site identifier> is the site’s unique identifier.

You will find the adsutil.vbs file in several places but you should probably use the one located at C:\Inetpub\AdminScripts.

IIS 6.0

IIS 7.0

Tags: , , , ,

Related posts

]]> http://sharepoint-geek.com/2010/02/26/enable-host-headers-on-an-sslhttps-site/feed/ 3