3

Using the FAST Content API with Sharepoint 2010 requires a SSL client certificate . At least that's what I understand from this error message"

Http error: HTTP/1.1 403 Could not verify client certificate.

I can configure my client to use a SSL certificate, but how do I import that into FAST? Since the content API ports are not handled by IIS, I can only assume that this is a FAST-specific configuration procedure.


Update: I've made the following steps:

  1. Generated a public+private key pair with the Java keytool application
  2. I've converted that keystore to to a PCKS12 (PFX) keystore which can be imported by Windows
  3. I've tried to import the keystore using the instructions for setting up SSL between FAST and Sharepoint, but I get a cryptic error

I can't make heads or tails of this but I can confirm that the certificate is installed alongside the FastSearchCert certificate in the Certificates (Local Computer) -> Personal -> Certificates Snap-In.

Note that the FAST machine is part of an AD, while the machine which generated the certificate is not.

PS C:\FASTSearch\Installer\scripts> .\securefastsearchconnector.ps1 -certPath c:\windows\temp\java-client-cert.pfx -ssaName FASTContent -username "CORP\Administrator"
Enter the certificate password: ******** 
Installed certificate.
Could not set access rights on certificates private keys. Script can be rerun to only set access rights when reason for error is detected.
Get-Acl : Cannot find path 'C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\6c8c8677fca4d588e808522374fc60aa_6c6a2f58-dc6a-42a6-80ac-19d3b57cafb5' because it does not exist.
At C:\FASTSearch\Installer\scripts\securefastsearchconnector.ps1:157 char:17
+         $acl = Get-Acl <<<<  $keypath$keyname
    + CategoryInfo          : ObjectNotFound: (:) [Get-Acl], ItemNotFoundException
    + FullyQualifiedErrorId : GetAcl_PathNotFound_Exception,Microsoft.PowerShell.Commands.GetAclCommand
1

You can skip ssl verification in content api by using this code:

ServicePointManager.ServerCertificateValidationCallback += (sender, certifcate, chain, sslPolicyErrors) => true;  

Insert it before using api calls.

7
  • if I understand correctly ( I'm using Java in my client calls ) this allows the client to not validate the Server's certificate. But in my case the server requires that the client present a SSL certificate. Jun 18 '12 at 14:41
  • To understand you correctly, you are using Java to pass content on to FAST, not the .NET content api? Jun 18 '12 at 19:07
  • @Mikael-SharePointMVP - that's correct Jun 18 '12 at 19:30
  • 2
    Thinking about it, java should work as the database connector uses it. If you follow the sample for .NET, it adds the thumbprint of the cert used when setting up https and passes this to the factory method of CreateDocumentFeeder. See C:\Program Files\Content API for Microsoft FAST Search Server 2010 for SharePoint\v1.0.15\examples\ContentAPIExample\ContentAPIExample.cs and the App.config file. Does that help, or have you already looked at it? Jun 19 '12 at 8:40
  • 1
    @Mikael-SharePointMVP - I've seen those examples ; Java is not that well integrated with the Windows keystore ,so a thumbprint is not enough . I've managed to make it work by exporting the Java application's keystore as a PFX ( PKCS12 ) file and importing it into the server keystore of the server running FAST. I'll post this as an answer when I have the process documented. Jun 20 '12 at 7:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.