2

In our environment, everything is configured for developing, deploying and using SharePoint apps. (Internal only).

A separate app-domain, an empty host header web application to receive all traffic to port 443, and a wildcard certificate for the app domain. The Cname/Alias for the apps is pointing to the SharePoint web front server FQDN (we only have one WFE for the moment in each farm) and the service applications are all set up and apps deploys and displays correctly.

SSL for apps work when you go to the app instance itself and i can see that the certificate is getting loaded correctly, but this is a bit shaky so sometimes the cert loads instantly, other times after an additional page refresh (F5).

Embedding an app in a SharePoint page breaks the SSL. The only thing i can find through FireFox is that the app certificate can't load with a very general error message.

The certificate is not trusted because the issuer certificate is unknown. The server might not be sending the appropriate intermediate certificates. An additional root certificate may need to be imported.

Are there any trust that needs to be configured because of the apps running from a separate domain? Do all the certificates needs to be added to SharePoints trusted cert store?

I've used fiddler and F12 developer tools in Chrome, IE, Firefox and Opera to see if there are anything that uses HTTP and breaks SSL but i have yet to found any element or reference that could be causing the issue.

Update

Just to be sure that there were no external javascript references or anything else that could break SSL, i created a new project and just wrote a classic "hello world" app, but the error remains.

  • Just had another thought... are the apps embedded with an iframe? – Burgi Oct 2 '15 at 13:35
  • Yes, i presume so. They are added just as a webpart. – Christoffer Oct 5 '15 at 11:30
  • All SharePoint Add-in / App parts (aka client web parts) run inside an iframe. Are you making any HTTP calls instead of HTTPS inside the app part, although your SharePoint environment is setup with SSL? Reading this article may help you out. – Mihail-Florin Popa Oct 15 '15 at 21:54
0

In Firefox the page info dialog lists the exact url it has pulled the media from, this includes scripts.

I can't find an example site with a broken SSL off-hand to demo the results but I used this method to fix the SSL on our corporate site. I remember this information not being visible in the dev tools in Chrome.

Firefox page info box showing the information from the Google homepage

Above is an example of the page info dialog in Firefox. It is accessible by rightclick on the page or Tools -> Page info


EDIT: I have managed to find a site with broken SSL encryption, please see the screenshot below:

Broken SSL on Verisign

I also found this SSL Server Test that might help you.

  • I've tried this in Firefox to no success sadly. What get's me the most is that all browsers are telling me different stuff. Any other suggestions? – Christoffer Oct 5 '15 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.