Hot answers tagged

8

I also tried to disable it on the server but in the end I solved it by using another method. What's curious is that the timeouts took 90 seconds instead of the 15 seconds that is the timeout specified for requesting the revocation status of the certificate. Activate the CAPI2 log in event viewer to enable logging for the actual validation requests that are ...


6

When you have several different websites routing to the same IP/port then the only way IIS knows where they should go is using the host header (the site address) Incoming Host Header Send to Web Application 192.168.0.1 : 80 websiteA.com A 192.168.0.1 : 80 websiteB.com B However if you're using SSL then The SSL certificiate is ...


6

The solution was to change sps3 to sps3s such that the url was sps3s://mysites. I thought I recalled another protocol but I couldn't find any hint of anything other than STS from the SharePoint 2007 days. I eventually stumbled upon this article which provided the answer as well as many other search crawl related issues and their solutions. After I found ...


5

Yes, you need to ensure your published URLS for your farm are setup to use HTTP as the traffic from your Netscaler to the farm will be in HTTP. This only matters for the published URLS as these are the URLS the Netscaler will use. Don't worry about the traffic between various servers in your farm as it doesn't make a difference from a SSL offload ...


5

Just to add what punchingInApepper already stated. SNI is a wonderful thing and is available in IIS 8.0. It has been around for some time like punchingInApepper stated but I have runned into some issues with SNI and multi-webapplication farms which I have not seen documented before so a bit of a warning; WebDAV (open with file explorer) will not function ...


5

Yes it is possible to use a single certificate. This needs to be a wildcard certificate. It can be a "Domain Certificate" as well as a certificate from a cert service as Verisign. Example: Your web applications in SharePoint could be like this. my.domain.com teams.domain.com documents.domain.com The wildcard certificate must be for *.domain.com. It ...


4

Actually, The reason you can't use one IP was a fault of IIS. There is an extension of TLS that allows a hostname to be specified. This has been around for years and is supported by all major browsers. The good news is that the latest version of IIS that comes with Windows Server 2012 supports this. So if you are running IIS 8, then good news, you can use ...


4

OK. This was actually a surprisingly straightforward answer and it's the direct result of a failed assumption, specifically that a non-trusted cert can be used. When connecting, the system would show me the questionable certs that it identified with an OK/cancel box to, presumably, accept the unsatisfactory certificate. Following a hunch, I grabbed our PKI ...


4

you dont need to extend the web app rather you have to update the IIS bindings. On the WFE servers, Add the Binding for the SSL & attach the certs. Now update the Https entry into the AAM via Central Admin. check this guide: http://blogs.msdn.com/b/sowmyancs/archive/2010/02/12/how-to-enable-ssl-on-a-sharepoint-web-application.aspx


4

Unless you don't care about security and replay attacks? No. TLS is used for the usual purposes for HTTPS sites (nothing SharePoint specific here). TLS is also used to protect the OAuth cookies when communicating between SharePoint and Office Online as well as SharePoint Addins.


3

If you changed the public URL in AAM & configured the IIS website to use SSL it will work without extending to a new website. However, whenever you will add a new webserver SharePoint will configure the original IIS settings that it knows about. That's why it's so important to specify the right public url & host header upon creation of a new web ...


3

The AutoSPInstaller (http://autospinstaller.codeplex.com/) was actually creating self-signed certificates on the server that the WAC did not trust. So we had to manually create the certs and a CA so that the trust would work properly. This corrected our issue.


3

You just have to set up the calendar sync with the appropriate web address using HTTPS. The error is telling you it's trying to connect to http://oldname.com/sites/abc/develop which isn't the URL you want configured. As a fallback, it is attempting to pull the calendar from http://prodname.com/sites/abc/develop, but that's hitting your HTTP Redirect in IIS. ...


3

No, this will not work if you only do that. If you make all of the configuration changes in IIS (on all of the WFE servers) to add the new binding to the IIS site, but without telling SharePoint about it then you'll get a SharePoint monster which sometimes will kind of work. Depending on how you navigate to the first page it'll show that using the https ...


3

SharePoint maintains it's own store of trusted root certificate authorities for use with it's own token service. Check out the technet blog post for more details: http://blogs.technet.com/b/speschka/archive/2010/02/13/root-of-certificate-chain-not-trusted-error-with-claims-authentication.aspx Open the SharePoint Management Shell to run the PowerShell ...


3

You cannot use a wildcard certificate as you have two different domain names. Instead, you need to use a SAN (also called UCC) certificate which can have multiple domain names attached to it. I'm not endorsing this vendor, but take a look at http://www.thawte.com/ssl/san-uc-ssl-certificates/index.html as an example of what you need to purchase.


3

After a break from the issue, I found what was wrong in my case. The firewall didn't allow connections between WFE- and APP-server(s). Don't bother to ask why and just leave it with it's due to "Organzational policies" :) I tried it with a simple telnet APPSRV 443 which failed. Opening the port got things working.


3

In a practice Port 80 used for http and 443 for https, But you can use the custom ports as per your requirements. If you are configuring the SSL for Web application then use 443. Here is good guide for configuring SSL for web application. https://blogs.msdn.microsoft.com/fabdulwahab/2013/01/20/configure-ssl-for-sharepoint-2013/


3

Manage trust is only needed if you like to consume/connect two different/several SharePoint farms to be able to communicate or share some services between them. If you only have one farm, you don't need to bother with those settings in CA. From Microsoft's official documentation: In SharePoint Server, a farm can connect to and consume a service ...


2

A single SP farm vs virtualizing many SP farms? A single SP farm can handle multiple SSL sites, as long as they're on unique IPs. A separate farm per site would be a waste of resources. SharePoint is designed to handle multiple. As far as maintainable, that would depend on your site collections and content databases and anticipate database sizes. Also, ...


2

Well, at last I found out what is happening. What I didn't know is that this Datapower was terminating SSL requests and forwarding in HTTP. The idea found here. Off-box termination of SSL is when a proxy server terminates an SSL request and then forwards the request to a Web server by using HTTP. I asked to the colleague that manages the Datapower and ...


2

The behavior is normal as the AAM doesn't know about your redirect, therefore the Workflow engine is not able to populate the proper Url. You should either use a Reverse'Proxy (e.g. ForeFront TMG, ISA 2006 ) that could automatically change your HTTP to HTTPS or Extend the Web Application to use HTTPS too. Besides you can make also enable the "Configure ...


2

You can use both HTTP and HTTPS. Just set up both as public URLs for your web application's respective zones. For example: If you extend a web application to the extranet zone, you can keep the public URL of the default (or intranet) zone as http://intranet.company.com. The public URL of the extranet zone would be https://intranet.company.com. Then you can ...


2

It could easily explainable by the concept of "Application Extension" in SharePoint, which is simply a mechanism that creates a new Web Application (it could be the same Host header too, but different Protocol, HTTP vs. HTTPS - with the purpose of offerring different authentication mechanism to different targeted people, e.g. Intranet vs. Extranet, Employees ...


2

SSL offloading will still meet the "use SSL for SPS 2013" train of thought. Whether SSL offloading is a risk in your environment is dependent on a number of things that only you can make the call on. The traffic between the client and the load balancer will be secure and the traffic between the load balancer and the web front ends will not be. Client PC -...


2

as ryan stated but there is a vital part missing for ssl! you need to add dns record for ssl aswell as adding the host header! start -> admin tools -> dns when the app loads, go into the server or add it in, expand "forward lookup zones" , expand the domain e.g. mydomain.com if you click on the domain name, you will see to the righ some folders and files ...


2

So you're saying you've got name.net as well as name.com as SANs within your certificate? For your canonical names you need *.name.net as a subject alternative name if you wish to use an unlimited number of canonical names. ADFS fully supports wildcard certificates if you create them with valid subject alternative names.


2

You have to open the Manage Computer Certificates which is certlm.msc (and not certmgr.msc). There youll find the SharePoint node. I'm running Windows Server 2012. Screenshots for demonstration.


2

I've been doing a great deal of research into this the past couple days as I'm in a similar situation. The evidence looks pretty strong that WebClient, the Windows service that is used by software to connect to a WebDAV resource does not support SNI. A SharePoint MVP echoed my suspicions that this is the case on another thread on the MSDN forums. At this ...


2

I solved this Problem thanks to this articles: http://support2.microsoft.com/kb/2625048 and http://www.ilikesharepoint.de/2014/04/sharepoint-event-id-8321-how-to-fix/ Maybe you have to (re-)add the certificate to the Local Trust Store in your SharePoint Installation. Central Administration > Security > Manage Trust


Only top voted, non community-wiki answers of a minimum length are eligible