Hot answers tagged

8

I also tried to disable it on the server but in the end I solved it by using another method. What's curious is that the timeouts took 90 seconds instead of the 15 seconds that is the timeout specified for requesting the revocation status of the certificate. Activate the CAPI2 log in event viewer to enable logging for the actual validation requests that are ...


6

When you have several different websites routing to the same IP/port then the only way IIS knows where they should go is using the host header (the site address) Incoming Host Header Send to Web Application 192.168.0.1 : 80 websiteA.com A 192.168.0.1 : 80 websiteB.com B However if you're using SSL then The SSL certificiate is ...


6

The solution was to change sps3 to sps3s such that the url was sps3s://mysites. I thought I recalled another protocol but I couldn't find any hint of anything other than STS from the SharePoint 2007 days. I eventually stumbled upon this article which provided the answer as well as many other search crawl related issues and their solutions. After I found ...


5

Just to add what punchingInApepper already stated. SNI is a wonderful thing and is available in IIS 8.0. It has been around for some time like punchingInApepper stated but I have runned into some issues with SNI and multi-webapplication farms which I have not seen documented before so a bit of a warning; WebDAV (open with file explorer) will not function ...


5

Yes, you need to ensure your published URLS for your farm are setup to use HTTP as the traffic from your Netscaler to the farm will be in HTTP. This only matters for the published URLS as these are the URLS the Netscaler will use. Don't worry about the traffic between various servers in your farm as it doesn't make a difference from a SSL offload ...


5

Yes it is possible to use a single certificate. This needs to be a wildcard certificate. It can be a "Domain Certificate" as well as a certificate from a cert service as Verisign. Example: Your web applications in SharePoint could be like this. my.domain.com teams.domain.com documents.domain.com The wildcard certificate must be for *.domain.com. It ...


4

Actually, The reason you can't use one IP was a fault of IIS. There is an extension of TLS that allows a hostname to be specified. This has been around for years and is supported by all major browsers. The good news is that the latest version of IIS that comes with Windows Server 2012 supports this. So if you are running IIS 8, then good news, you can use ...


4

OK. This was actually a surprisingly straightforward answer and it's the direct result of a failed assumption, specifically that a non-trusted cert can be used. When connecting, the system would show me the questionable certs that it identified with an OK/cancel box to, presumably, accept the unsatisfactory certificate. Following a hunch, I grabbed our PKI ...


4

you dont need to extend the web app rather you have to update the IIS bindings. On the WFE servers, Add the Binding for the SSL & attach the certs. Now update the Https entry into the AAM via Central Admin. check this guide: http://blogs.msdn.com/b/sowmyancs/archive/2010/02/12/how-to-enable-ssl-on-a-sharepoint-web-application.aspx


4

Unless you don't care about security and replay attacks? No. TLS is used for the usual purposes for HTTPS sites (nothing SharePoint specific here). TLS is also used to protect the OAuth cookies when communicating between SharePoint and Office Online as well as SharePoint Addins.


3

No, this will not work if you only do that. If you make all of the configuration changes in IIS (on all of the WFE servers) to add the new binding to the IIS site, but without telling SharePoint about it then you'll get a SharePoint monster which sometimes will kind of work. Depending on how you navigate to the first page it'll show that using the https ...


3

SharePoint maintains it's own store of trusted root certificate authorities for use with it's own token service. Check out the technet blog post for more details: http://blogs.technet.com/b/speschka/archive/2010/02/13/root-of-certificate-chain-not-trusted-error-with-claims-authentication.aspx Open the SharePoint Management Shell to run the PowerShell ...


3

The AutoSPInstaller (http://autospinstaller.codeplex.com/) was actually creating self-signed certificates on the server that the WAC did not trust. So we had to manually create the certs and a CA so that the trust would work properly. This corrected our issue.


3

If you changed the public URL in AAM & configured the IIS website to use SSL it will work without extending to a new website. However, whenever you will add a new webserver SharePoint will configure the original IIS settings that it knows about. That's why it's so important to specify the right public url & host header upon creation of a new web ...


3

You cannot use a wildcard certificate as you have two different domain names. Instead, you need to use a SAN (also called UCC) certificate which can have multiple domain names attached to it. I'm not endorsing this vendor, but take a look at http://www.thawte.com/ssl/san-uc-ssl-certificates/index.html as an example of what you need to purchase.


3

After a break from the issue, I found what was wrong in my case. The firewall didn't allow connections between WFE- and APP-server(s). Don't bother to ask why and just leave it with it's due to "Organzational policies" :) I tried it with a simple telnet APPSRV 443 which failed. Opening the port got things working.


3

In a practice Port 80 used for http and 443 for https, But you can use the custom ports as per your requirements. If you are configuring the SSL for Web application then use 443. Here is good guide for configuring SSL for web application. https://blogs.msdn.microsoft.com/fabdulwahab/2013/01/20/configure-ssl-for-sharepoint-2013/


2

Either use the methods in this link to turn on error messages, or you should be able to log on to the physical server to see the detailed error messages.


2

I figured out my problem and it was a little thing. The whole time I was receiving this error, I was connected via HTTP and not HTTP*S*! Once I connected using HTTPS, I could check out documents just fine. Boy that's frustrating!


2

Found the issue. Had to use a wildcard cert. I have multiple web apps binded to port 443. I stop the web apps sites on the server that are not needed. Looks like SharePoint doesn't care that the site is stopped or started. Still need to have a correct cert in order for the sync to work properly.


2

Add the HTTPS version of the URL to the Alternate Access Maps in Central Administration. Even though it isn't actually reaching SharePoint with HTTPS, search needs to know that having HTTPS in the URL is valid for that content.


2

Do you have the AAMs set up for the My Site Host?


2

A single SP farm vs virtualizing many SP farms? A single SP farm can handle multiple SSL sites, as long as they're on unique IPs. A separate farm per site would be a waste of resources. SharePoint is designed to handle multiple. As far as maintainable, that would depend on your site collections and content databases and anticipate database sizes. Also, ...


2

Well, at last I found out what is happening. What I didn't know is that this Datapower was terminating SSL requests and forwarding in HTTP. The idea found here. Off-box termination of SSL is when a proxy server terminates an SSL request and then forwards the request to a Web server by using HTTP. I asked to the colleague that manages the Datapower and ...


2

You can use both HTTP and HTTPS. Just set up both as public URLs for your web application's respective zones. For example: If you extend a web application to the extranet zone, you can keep the public URL of the default (or intranet) zone as http://intranet.company.com. The public URL of the extranet zone would be https://intranet.company.com. Then you can ...


2

It could easily explainable by the concept of "Application Extension" in SharePoint, which is simply a mechanism that creates a new Web Application (it could be the same Host header too, but different Protocol, HTTP vs. HTTPS - with the purpose of offerring different authentication mechanism to different targeted people, e.g. Intranet vs. Extranet, Employees ...


2

The behavior is normal as the AAM doesn't know about your redirect, therefore the Workflow engine is not able to populate the proper Url. You should either use a Reverse'Proxy (e.g. ForeFront TMG, ISA 2006 ) that could automatically change your HTTP to HTTPS or Extend the Web Application to use HTTPS too. Besides you can make also enable the "Configure ...


2

You just have to set up the calendar sync with the appropriate web address using HTTPS. The error is telling you it's trying to connect to http://oldname.com/sites/abc/develop which isn't the URL you want configured. As a fallback, it is attempting to pull the calendar from http://prodname.com/sites/abc/develop, but that's hitting your HTTP Redirect in IIS. ...


2

So you're saying you've got name.net as well as name.com as SANs within your certificate? For your canonical names you need *.name.net as a subject alternative name if you wish to use an unlimited number of canonical names. ADFS fully supports wildcard certificates if you create them with valid subject alternative names.


2

as ryan stated but there is a vital part missing for ssl! you need to add dns record for ssl aswell as adding the host header! start -> admin tools -> dns when the app loads, go into the server or add it in, expand "forward lookup zones" , expand the domain e.g. mydomain.com if you click on the domain name, you will see to the righ some folders and files ...


Only top voted, non community-wiki answers of a minimum length are eligible