1

Short question

How can I configure the port to be used by SharePoint when accessing the app domain/app web?

Details

I want to configure a non-default SSL port for my app URLs:

enter image description here

You see how SharePoint doesn't let me do it (in this dialog).

I want to use a non-default SSL port for my app web, so any non-443 port.

Background

In a test scenario I need to do something like this ("Running Multiple SharePoint SSL Websites on Separate SSL Certificates Using Server Name Indication"), but without SNI since I'm on IIS 7.5. On the same IIS site I want to configure different bindings for the SharePoint portal and the app web using two different certificates:

enter image description here

Only one of the bindings can use port 443 - that shall be my portal, reachable by end users. Now how to configure the wildcard binding for the app web to use another port?

Currently calls to my apps try to access the app web URL at port 443: "https://apps-de4f1d871b8e93.apps.demo.local/sites/" I want that to be like this: "https://apps-de4f1d871b8e93.apps.demo.local:444/sites/"

Note: I already added the app domain as app-specific alternate access mapping like this:

New-SPWebApplicationAppDomain –AppDomain “apps.demo.local” –port 444 -SecureSocketsLayer –WebApplication https://portal.demo.local

What else is necessary to get SharePoint call the app web on port 444?

Note: this question is explicitly about this configuration. I know there are alternative ways to achieve similar goals, but I want to know if this configuration can work.

Improve this question

2 Answers 2

Reset to default
0

I think I found the answer myself.

From the Technet documentation:

The app domain must use the same protocol and port as the web application hosting the parent site collection. So, if your app domain uses HTTP, then the hosting site collection must use HTTP as well.

So it's not possible to do what I described.

Improve this answer
0

Your problem can be seen very often in SSL-Environments. You have to get your App-Requests in another WebApplication (i call it "AppDummy"). There you can configure your second certificate.

BTW: Same problem exists with Kerberos-Enabled WebApplications! It's not practicable to create a separate SPN for each app. So the AppDummy WebApplication should always be configured with NTLM.

Step-by-Step:

Netsh Int IPv4 Add Address "Interface Name" "IP Address" SkipAsSource=True

  • Change the DNS Wildcard-Record of your App-Domain to the new IP-Address
  • Create a separate WebApplication. The WebApplication must be running under the same Service-Account as your existing WebApplication
  • I call this WebApplication "AppDummy" by name. It is only used to receive App-Requests.
  • Give it any URL in AAM. I normally use the App-domain. In your case https://apps.demo.local. But it really doesn't matter.
  • Configure the IIS-Binding of the AppDummy to use your newly assigned IP-Address. If it's not in the list, simply write it with your keyboard. In this configuration you can and should use port 443. Do not configure a hostname in the binding. Select your Wildcard App-Certificate.

Excellent background-article.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.