3

I'm trying to configure SharePoint 2013 environment for both type of apps provider- and sharepoint-hosted. I was able to do it based on http, however switching to https causes me trouble. I have fully functional configuration for provider-hosted apps, it is sharepoint-hosted apps not behaving as I would like to with their separate domain.
I have a server with two network adapters with two different IP addressess IP1 and IP2. I have already established SharePoint Web App with site collection configured for IP1 - this works with https as I was able to successfuly assign wildcard ssl certificate to this in IIS. (lets say its name is portal.mysite.com so my wildcard SSL cert is *.mysite.com). I created new domain in DNS called apps.mysite.com with an A Host configured for my IP2 address, which pings correctly using IP2 address.
Now, I created a new Web App without hostname and assigned the wildcard ssl certificate *.apps.mysite.com to it as well as IP2 address. My previously created portal.mysite.com has a host header in IIS as well as IP1 address.
https://portal.mysite.com works without problems. I am able to correctly deploy and launch provider-hosted app. However, while trying to deploy and launch sharepoint-hosted app I get the reponse that the following page does not exist
https://app-c037c80c25ff5d.apps.mysite.com/sites/devsite/SharePointApp32SH/Pages/Default.aspx?SPHostUrl=(...).
If anybody has any idea what I missed or did wrong with this setup please share any of your ideas. I am out of them myself.

Improve this question

1 Answer 1

Reset to default
1

I actually always configure the App-Domain DNS / SSL bindings on the same web app you have used for your SharePoint sites (assuming you are using Host Named Site Collections). In the background SharePoint creates a sub-site within the same site collection but uses some clever routing to make it appear under a different URL.

Also, the App Domain needs to be a different root domain from your SharePoint URLs, this is to protect against cross-site scripting attacks. With your portal site running at portal.mysite.com and your apps running at app-guid.apps.mysite.com then they are both on the same root domain mysite.com.

It is recommended instead to use a completely different domain (such as apps-mysite.com) which then has a wildcard DNS record and wildcard SSL cert for the *.apps-mysite.com entry.

So in your example:

  • IIS Site for SharePoint Web Application
    • IP1 Binding to *.mysite.com
    • IP2 Binding to *.apps-mysite.com
Improve this answer
3
  • What about in a multiple WFE environment? So, with 3 WFEs, you'll have a total of 8 IP addresses, 3 for mysite.com, 3 for *.apps-mysite.com, plus 2 public IPs for the load balancer. Am I missing any issues/gotchas for the multiple WFE environment?
    – Mike2500
    Commented Mar 11, 2014 at 16:25
  • 1
    Nope, that is totally correct. If you have two different SSL secured domains coming in then you need two different IP addresses at each point. Two on each server, and two on the load balancer (so yes, 8 in total). Note though, you don't HAVE to have multiple network adapters. A single NIC can have multiple IP addresses
    – Martin Hatch
    Commented Mar 11, 2014 at 16:41
  • OK I created separate domain: portalapps.com. In DNS for this domain I entered A Record pointing at second IP address of my SharePoint Server. Because I use host headers in my SharePoint configuration I created separate Web App without host headers (taken from sharepointchick.com/archive/2012/07/29/…) and binded it to the wildcard *.portalapps.com certificate. It stil, however, doesn't work at all...
    – kruczer
    Commented Jun 5, 2014 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.