1

I need to create a new Web app accessible from outside with HTTPS and offload certificate at F5.
So the communication from F5 to SP server will be HTTP.

My first question is: when creating a Web app for this so I need to select "Yes" in "Use Secure Socket layers" section;
and second question is: do I need to change the Public URL from HTTP to "HTTPS"?

I have tried different ways and set up my AAM as mentioned here and here but none is working, please advise

0

What you have to do is:

  1. Create the Web application with HTTP, not SSL. That's because SharePoint won't deal with the SSL part at all. Let's you use the URL "http://server" at creation time: this URL will be the one used when you browse the site internally, without HTTPS (for troubleshooting purpose for instance, it's always good to have a direct access to the application).
  2. Once the application is created, go to its AAM settings, and edit its public URL: the default one is already set to "http://server". Add a public URL (in any zone: Extranet, Intranet... it doesn't matter these are just "mnemonics" and don't have technical impacts -only the default may have an impact). This new public URL is the HTTPS URL used by external users (the one received by the F5), e.g. "https://server.example.com". Let's say you chose "Extranet" (i.e. "Extranet" textbox contains "https://server.example.com").
  3. Still in the AAM settings, add an internal URL, one like "http://IP_ADDRESS", and map it to the zone you created the public URL on. e.g. "Extranet".
  4. Configure the F5 to redirect the incoming requests to "http://IP_ADDRESS".
  • Thanks for the steps, I tried these steps but it did not work. regarding step 3 and 4 I assume you meant F% load balanced IP address ? in my case F5 is already configured to send traffic to the URL/DNS name ( not IP ) . any other thoughts ? btw http is working fine with host file on server , only https is not working. – Umr Jun 12 '17 at 18:36
  • I meant the IP address of the SharePoint server. Or the URL/DNS name you configured in the F5 to redirect to SP. – Evariste Jun 12 '17 at 20:07
  • I am using FDQN to create every thing. so URL in step 1 is also server.example.com in my case and due to that reason I am getting URI already exist . Earlier I tried with IP. – Umr Jun 12 '17 at 20:32
  • OK. Having the same URL for internal and external access is maybe not the standard approach. Will your internal users access SharePoint through F5 and its HTTPS connector? – Evariste Jun 13 '17 at 5:21
  • Thanks Evariste for response , all users will go through F5, internal & external , but my understanding is even for that scenario we should make http to work as well so that internal call to SharePoint like crawling , user profile function properly. Any thoughts ,suggestions ? Thanks ! – Umr Jun 13 '17 at 13:55
2

SSL Offloading is a significant security risk. I would recommend looking into SSL Bridging instead. As SharePoint uses OAuth tokens to communicate with sources such as Office Online Server, Exchange, WFM, Apps, and others, those tokens must be in a secure state as they are otherwise transmitted in the clear. Intercepting those tokens can lead to a replay attack.

That said, you would use the HTTP scheme and no to SSL.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.