0

We have SharePoint 2013 SP1, external resource in corporate subnet (video.domain.com) is set as a content source in SharePoint farm search service application (sharepoint.domain.com).

Ignore SSL warning is set to Yes in Search farm administration.

When trying to crawl the content source, the following error occurs:

The secure sockets layer (SSL) certificate sent by the server was invalid and this item will not be crawled. (0x80041223)

No further ULS logs are shown, even if level is set to Verbose.

I have the only one idea that due to wildcard type of certificate it is not recognized by SharePoint (see screenshot).

Wildcard certificate

Update:

This is how Chrome displays the certificate (including SAN): enter image description here

Improve this question
3
  • Is it crawling "video.domain.com" or "hostname.video.domain.com"? That wildcard isn't valid for "video.domain.com".
    – Trevor Seward
    Nov 22 '16 at 18:17
  • Content source is set as video.domain.com but certificate is for *.video.domain.com. Certificate's SAN is: DNS Name= *.video.domain.com DNS Name=video.domain.com. According to wiki (en.wikipedia.org/wiki/Wildcard_certificate), a single wildcard certificate for *.example.com, will secure all these domains: payment.example.com contact.example.com login-secure.example.com www.example.com, which match my case.
    – Sergey
    Nov 22 '16 at 22:02
  • I've checked certificate once more - in SAN field stated two entries: DNS Name=*.video.domain.com; DNS Name=video.domain.com Which means, according to wiki (en.wikipedia.org/wiki/Wildcard_certificate), "The "naked" domain is valid when added separately as a Subject Alternative Name (SubjectAltName): example.com". This is just my cause.
    – Sergey
    Nov 23 '16 at 6:29
0

After performing some research I've found that the reason was in security protocols. Our security department has forced additional cipher suites activation on all hosts in network using group policy update but some machines were outdated. Enabling gpupdate /force on SharePoint crawl servers helped solve this issue.

Here are these suites:

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P521
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256

Hth

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.