3

Using the FAST Content API with Sharepoint 2010 requires a SSL client certificate . At least that's what I understand from this error message"

Http error: HTTP/1.1 403 Could not verify client certificate.

I can configure my client to use a SSL certificate, but how do I import that into FAST? Since the content API ports are not handled by IIS, I can only assume that this is a FAST-specific configuration procedure.

Update: I've made the following steps:

  1. Generated a public+private key pair with the Java keytool application
  2. I've converted that keystore to to a PCKS12 (PFX) keystore which can be imported by Windows
  3. I've tried to import the keystore using the instructions for setting up SSL between FAST and Sharepoint, but I get a cryptic error

I can't make heads or tails of this but I can confirm that the certificate is installed alongside the FastSearchCert certificate in the Certificates (Local Computer) -> Personal -> Certificates Snap-In.

Note that the FAST machine is part of an AD, while the machine which generated the certificate is not.

PS C:\FASTSearch\Installer\scripts> .\securefastsearchconnector.ps1 -certPath c:\windows\temp\java-client-cert.pfx -ssaName FASTContent -username "CORP\Administrator"
Enter the certificate password: ******** 
Installed certificate.
Could not set access rights on certificates private keys. Script can be rerun to only set access rights when reason for error is detected.
Get-Acl : Cannot find path 'C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\6c8c8677fca4d588e808522374fc60aa_6c6a2f58-dc6a-42a6-80ac-19d3b57cafb5' because it does not exist.
At C:\FASTSearch\Installer\scripts\securefastsearchconnector.ps1:157 char:17
+         $acl = Get-Acl <<<<  $keypath$keyname
    + CategoryInfo          : ObjectNotFound: (:) [Get-Acl], ItemNotFoundException
    + FullyQualifiedErrorId : GetAcl_PathNotFound_Exception,Microsoft.PowerShell.Commands.GetAclCommand
Improve this question

1 Answer 1

Reset to default
1

You can skip ssl verification in content api by using this code:

ServicePointManager.ServerCertificateValidationCallback += (sender, certifcate, chain, sslPolicyErrors) => true;

Insert it before using api calls.

Improve this answer
7
  • if I understand correctly ( I'm using Java in my client calls ) this allows the client to not validate the Server's certificate. But in my case the server requires that the client present a SSL certificate.
    – Robert Munteanu
    Jun 18, 2012 at 14:41
  • To understand you correctly, you are using Java to pass content on to FAST, not the .NET content api?
    – Mikael Svenson
    Jun 18, 2012 at 19:07
  • @Mikael-SharePointMVP - that's correct
    – Robert Munteanu
    Jun 18, 2012 at 19:30
  • 2
    Thinking about it, java should work as the database connector uses it. If you follow the sample for .NET, it adds the thumbprint of the cert used when setting up https and passes this to the factory method of CreateDocumentFeeder. See C:\Program Files\Content API for Microsoft FAST Search Server 2010 for SharePoint\v1.0.15\examples\ContentAPIExample\ContentAPIExample.cs and the App.config file. Does that help, or have you already looked at it?
    – Mikael Svenson
    Jun 19, 2012 at 8:40
  • 1
    @Mikael-SharePointMVP - I've seen those examples ; Java is not that well integrated with the Windows keystore ,so a thumbprint is not enough . I've managed to make it work by exporting the Java application's keystore as a PFX ( PKCS12 ) file and importing it into the server keystore of the server running FAST. I'll post this as an answer when I have the process documented.
    – Robert Munteanu
    Jun 20, 2012 at 7:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.