I recently learnt that TLS negotiation is done by the Windows Server. But, in IIS we can bind SSL certificate for specific domain. Doesn't it means that IIS takes care of TLS offloading? Is this true, even when we configure IIS as reverse proxy?
Thanks in advance.
Related
I have recently got an SSL certificate on my website, on the apache server that I am using to host my website. The website says "Secure" and also works fine when I run it over localhost using the laptops ip address 192.168.*.**. But when I try to port forward this website over the port 443, it somehow says unsecure and your connection is not private. Any help here will be appreciated.
It sounds like you are using a self-signed certificate for your https connection. While modern browsers such as chrome give you errors saying the connection is unsecure and perhaps you even see red lines crossing out the https at the beginning of your url, there is no need to worry. If you are getting your page to render with these characteristics all is working, the reason for the errors is because the certificate is signed only for you.
In a real world production scenario you would have to use a third party service for a public capable certificate. However for your own development purposes, as long as the page runs with https there all is working as it is intended to.
For more try reading this article.
I have configured my WSUS server on Windows Server 2012 R2, and I want all the communications between the server and the clients in HTTPS.
The problem is even after a proper IIS configuration with HTTPS only activated. The clients seem to try to communicate with both HTTP and HTTPS. More precisely BITS seems to cause this problem.
So is there anyone of you who have managed to fix this issue?
Thanks
I have been debugging my software by connecting an iphone which is on the same network. Then I use fiddler on my desktop/server and set it to Allow Remote Connection (instructions here). I had this configuration working under Windows Server 2012, since I've upgraded my server to Server 2016 I am no longer able to get the phone to connect to the proxy server at xx.xx.xx.xx:8888. I checked "Allowed Apps" in the Windows Firewall but I don't see anything that looks relevant in there.
I am able to connect to the web server I have running on my server 2016 from my phone so they are able to talk to each other. I just can't access the fiddler proxy server.
Fiddler says it is online and appears to be working correctly.
I'm using Fiddler v4.6.20171.7553.
Is there some setting in windows firewall that might be blocking my proxy server connection?
I figured it out. I changed the firewall settings in Windows firewall to ask me if an app was going to be blocked. After restarting fiddler I was prompted and I said yes, allow this app to go through the firewall and then it started working.
I am working to setup my application to watch calendar events through Google's Calendar API. In doing so I must setup a "Push" endpoint on my server that has a valid SSL certificate (not self-signed).
My production environment is running on Heroku so setting up an SSL cert was easy using Expidited SSL. I have two CNames setup in GoDaddy, one for my production application and one for my development environment tunneled through ngrok. I'm using the paid ngrok feature of white labeled domain tunneling (dev.mydomain.com).
Host Points To
www saga-1234.herokussl.com
dev ngrok.com
The problem is that my ssl certificate is recognized when you hit the production application (www.mydomain.com), but it uses ngrok's certificate when you visit the development application (dev.mydomain.com).
How can I setup my ngrok tunnel to use my ssl certificate?
Ngrok's white labeled domain does not support HTTPS if you are using your own domain. Simply because it serves it's own certificate, where you need to serve your domain's. That's why you are getting certificate mismatch issue.
Here's what you could do to watch calendar events on your dev machine:
Point ngrok.mydomain.com to another server, let's say a new EC2
micro instance
Point wildcard CNAME to ngrok.mydomain.com
Compile ngrok server and client to use your certificate (rather than
ngrok.com)
Run the ngroku-server on EC2 instance
On your dev machine config the client to use ngrok.mydomain.com instead of ngroku.com
Run ngrok -subdomain=dev 80
Your local dev machine's 80 port should be accessible via https://dev.mydomain.com
This is really cool and is very helpful when debugging Google's webhooks, which require valid HTTPS and a verified root domain name.
Another interesting trick is to use CloudFlare's universal SSL to have a valid https://dev-machine.mydomain.com pointing to your dev machine without purchasing a certificate. The steps are exactly the same except that you need to issue your own certificate for ngrok client-server communications and use CloudFlare's Flex SSL for dev-machine.yourdomain.com.
ngrok has a new feature that tunnels and terminates SSL. Thus you can use your own domain and HTTPS. No need to open ports in your router or PC. They call it TLS Tunneling. The following is a link to a GitHub repos that describes how to do it.
How to use your own domain to access your home PC over the internet. Use HTTPS without raising SSL errors.
I have a custom soap-service for windows server which listens on a portnumber (for ex. 1024). When I make a call to this service using http:// (ip or domain):1024 the service works well.
When I try to make the same call to https:// (ip or domain):1024 I get the following response:
SSL connection errorUnable to make a secure connection to the server.
This may be a problem with the server, or it may be requiring a client
authentication certificate that you don't have.
When I try to connect to the same ip without the portnumber my IIS responds without any issue (I have a certificate installed).
Any help would be welcome!
Let's clarify:
a)-- Your delphi code is directly opening a socket and listening on a port
or
b)-- Your delphi code is hosted by IIS, and IIS is listening on a port
If it is 'a', then you need to add SSL support to your delphi app, so that your delphi app can speak SSL to clients. E.g. if you use Indy, or remote objects, or whatever, then your SSL work will happen at that level.
If it is 'b' then you go through the standard process of IIS SSL management (e.g. create a request file in IIS, then purchase a cert, then install the cert in IIS.... http://support.microsoft.com/kb/299875 )