Setting up HTTPS: Difference between revisions

From NEOSYS Technical Support Wiki
Jump to navigationJump to search
Line 1: Line 1:
== Setting up HTTPS for NEOSYS website ==
== Setting up HTTPS for NEOSYS website ==


NEOSYS has a very simple way of enabling https for all the clients. Every client have been set up with domain name " *.hosts.neosys.com " where "*" is the clientname.
NEOSYS has a very simple way of enabling https for all the clients. Every client have been set up with domain name " *.hosts.neosys.com " where "*" is the clientname. If the domain name is not standard do not change the URL that has been in use for many years without a good enough reason.


Pre prepared certificate for *.hosts.neosys.com web sites is present on the nl10r/win3 server. The certificate is signed by COMODO and supports SHA2 security algorithm. It is portable, ensures authenticity and is widely supported.
Pre prepared certificate for *.hosts.neosys.com web sites is present on the nl10r/win3 server. The certificate is signed by COMODO and supports SHA2 security algorithm. It is portable, ensures authenticity and is widely supported.

Revision as of 05:31, 23 February 2016

Setting up HTTPS for NEOSYS website

NEOSYS has a very simple way of enabling https for all the clients. Every client have been set up with domain name " *.hosts.neosys.com " where "*" is the clientname. If the domain name is not standard do not change the URL that has been in use for many years without a good enough reason.

Pre prepared certificate for *.hosts.neosys.com web sites is present on the nl10r/win3 server. The certificate is signed by COMODO and supports SHA2 security algorithm. It is portable, ensures authenticity and is widely supported.

Creating a single HTTPS web site on Windows 2008

To create a single HTTPS web site on Windows 2008, follow three simple steps:

  • Copy the "*.hosts.neosys.com.pfx" certificate saved in d:\hosts\certificates on win3 to the server. (password to be used is present in a text file in the same folder)
  • Import the certificate to IIS without option to export and MUST be deleted after import. See Importing certificate in IIS for details.
  • Click on Sites > Client Web Site > Bindings. In the Bindings section - click on Add and select https, All Unassigned IP addresses, port 4430 and select the certificate from the drop down and click OK.

Sslwin2008-2.jpg Sslwin2008-3.jpg

Sslwin2008-4.jpg

Test the site from explorer to make sure it works.

Creating a single HTTPS web site on Windows 2003

  • Copy the "*.hosts.neosys.com.pfx" certificate saved in d:\hosts\certificates on win3 to the server. (password to be used is present in a text file in the same folder)
  • Click on Sites > Properties > Directory Security > Server certificate. Follow the steps in the wizard to import/bind the certificate to port 4430. See Importing certificate in IIS for detailed steps to import.

Creating multiple HTTPS web sites on NEOSYS hosted server

All clients hosted on NEOSYS servers use the same IP address but unique HTTPS port numbers starting from 4431 onwards. The unique port number should be one greater than the highest port number available on the server under IIS manager -> NEOSYS ->Sites.

  • Click on Sites > Client Web Site > Bindings. In the Bindings section - click on Add and select https, All Unassigned IP addresses, port 4430 and select the "*.hosts.neosys.com.pfx" certificate from the drop down and click OK.

Since the http access is not required for any Client on NEOSYS hosted server, this step of https binding can be performed while creating the client website as shown in the screen shot below.

IISwin3.png

Steps to follow while importing certificate and why

  1. It MUST be imported WITHOUT OPTION TO EXPORT and
  2. It MUST be deleted after import.

It is especially important to keep pfx files off clients own servers because they are commonly directly exposed to potentially infected employees computers and/or personal devices via the corporate LAN so they may be far less secure than NEOSYS own servers which are reasonably well isolated. If a pfx file is obtained by criminal hackers, perhaps using automated tools, and the pfx password guessed, brute forced, or broken in some way, the keys contained could in principle be used against us or our clients. If the pfx file is a wildcard that supports any subdomain, then loss in one place could affect others. The chances of all this happening is probably very low but NEOSYS needs to be prepared to pass IT audits and leaving keys around will be viewed as having a culture of low security standards.

Setting up HTTPS for installations with more than 1 database

In cases where there are multiple databases within the same installation, you can use the same website to access all the databases. In case the Client asks for separate domain names for multiple databases, use the same steps as explained in Setting up HTTPS as the case maybe.

Troubleshooting setup of multiple HTTPS websites

Error while binding COMODO signed certificate to NEOSYS website

Test11.jpg

You can fix this error by importing the certificate using the MMC (Microsoft Management Console) instead of directly doing it from IIS.

Follow the link for instructions: http://support.microsoft.com/kb/232137