Hello my friends, I thought that to start blogging about SharePoint 2010 with very basics, like creation of the site with host address that configured in the DC, enable SSL, enable Kerberos authentication etc.
Being a developer we won’t do these configurations regularly but for admin guys it will be a cake walk J
So, let me start with the details of my machine details. I have two machines, first machine is my Domain Controller with Active Directory, I have installed SQL server 2008 with SP1 + CU2 in this machine.
Second machine has SharePoint 2010 Public Beta, Visual Studio 2010 Beta, Office 2010 Beta, SharePoint designer 2010 Beta
Both machines are running with Windows Server 2008 R2 and domain name is “sowmyan.com”
My first task is create a very basic team site with a URL www.sowmyan.com
1. First I am going to enter a host entry in the DNS in my Domain Controller(you can do it even after creating the site, but here I am going to add a new host entry with name “www”, thus the FQDN will be www.sowmyan.com) and pointing it to the IP address of my SharePoint server.
2. Now create a new web application in SharePoint central administration site. While creating the web application specify the port as 80 and host header as www.sowmyan.com, so while accessing the URL it will be neat and no need to specify port number.
3. After creating the web application creating a new site collection at the root.
4. Once the site got created browse to the site and if there is a loop back check then we can’t successfully login to the site, it may prompt for credentials 3 times and will show blank page. To resolve this issue follow the below KB article :
In my environment the issue got resolved after adding the DisableLoopBackCheck entry in the registry settings and a reboot by following the above mentioned KB.
5. Finally here is our site J
Now we will see how we can make our site SSL enabled.
Note: strongly recommend to use Central Administration or PowerShell to extend the web application with port HTTPS instead of doing the manual HOST name entry IIS by adding a new URL in AAM like the below method . Once you get the second IIS website , you can configure the SSL certificate binding in IIS. Specifically with the claim based authentication as the default option in SharePoint 2013 and NTLM deprecated, it is highly recommend to implement the zones using AAM. Also, in 2013 you can implement streamlined topology where a single web application with Host Named Site Collections with the support for zones. When I wrote this post , SharePoint 2010 was on beta stage :)
We can either configure the web application to use SSL whenever we create new web application or extend the web application. In my scenario since I'm going with the manual method (which is not suggested - please follow the above note).
For that I am going to do the following.
1. Go to Alternate Access Mappings: Central Administration à Application Management à Alternate Access Mapping.
2. Select the web application in the right most drop down and click on “Add Internal URLs”
3. Add a new URL with HTTPS, here I have added https://www.sowmyan.com and select a zone, here I have
selected Intranet zone. Then AAM collection will show the list of URLs with zones.
4. Now if we try to browse to the site using https it won’t browse because we have to install the certificate and
configure the website in IIS.
5. If you are not using DNS host entry then can create a self-signed certificate in IIS 7 or get a certificate from a third
party CA and can bind it with your SharePoint website. You can refer the following article for getting more
information about it.
Follow the below TechNet to know more about the “Configuring Server Certificates in IIS 7”
But in my scenario since I am using DNS and thus I can’t use self-signed certificate if the host entry is in DNS. If I use a self-signed certificate I will get a Certificate Error:
For that I have to first add “Active Directory Certificate Service” Role in my Domain Controller. Please follow my post to know how to add that role in Windows 2008 R2.
Now we are ready for the configuration of IIS website for SSL.
1. Double click on “Server Certificates” and it will open the configuration window.
2. On left side it will show the actions, and select “Create Domain Certificate”.
3. It will open the below window and provide the details, but make sure the certificate's "Common Name" (CN) matches the host header in the request, e.g. if the client is making a request to www.contoso.com, then the CN must also be www.contoso.com
4. In the next screen you have to provide the Online Certification Authority details. You have to provide it in a specific format like below ( see the red box)
If you don’t know the certification authority’s name then open the server manager in the DC machine and can find it out under “Active Directory Certificate services”
You may get some error if you didn’t specify the certificate authority name correctly or didn’t import it to the local machine’s trusted certificates folder (how it is done here – last portion)
5. Once it completed successfully you can see the certificates and once you click on the newly created certificate you
can see the details.
6. Next step is create a new binding with HTTPS and use the certificate that we just created.
Create an SSL Binding
Select a site in the tree view and click Bindings... in the Actions pane. This brings up the bindings editor that lets you create, edit, and delete bindings for your website. Click the Add... button to add your new SSL binding to the site.
New bindings default to http on port 80. Select https in the Type drop-down. Select the certificate that we created earlier from the SSL Certificate drop-down and click OK.
Now you have a new SSL binding on your site and all that remains is to verify that works.
Verify the SSL Binding
Look in your site's Actions pane for a link that will browse your site over your new HTTPS binding. Click this link to test your new binding.
Once it is done just browse to your site with https: If everything is fine then you can see a small lock sign in the address bar and once you click on it will give you the details of your certificate and it will say that the connection to the server is encrypted.
Thank you for this post. It's help me a lot ;)
Thank you for the post, this helps alot.
I do have a further problem, after I did all of this, my webparts are breaking. I can view a Issue list, Document Library or anything. Any ideas?
1. After changing to HTTPS do an IIS Reset and see the behaviour
2. Make sure that everything working correctly without SSL by turning it off and removing all entries from
3. If it is test / dev machine run the PSConfig wizard without disconnecting from the farm and see the
what type of authentication that you are using ?
Thank you for the reply.
Everything is working 100% on normal http, but when viewing the page in HTTPS, the web parts fail to load.
We are running NTLM authentication, authenticating through our AD server.
I have done an IIS reset, i have even completely rebooted the server last night, but no joy. :(
hmm, try to run the PSConifg wizard and see the behaviour, Haven't encountered this issue before, if you are really stuck then contact Microsoft Customer service support for getting assistance.
We have successfully set up an extranet website with FBA in place using this walkthrough, however, we are trying to do the same with a second website and it's not working. We have used a different IP address on the bindings and it's a different certificate but when we try to navigate the url appears to be going to the correct IP address but the page never loads. In the status bar of the browser it says "Connect to extranet.lighthouseas.co.uk" (the same with a fully qualified https address and there is a URL rewrite in place that would be redirecting to https if the browser was actually reaching it).
Is there some sort of issue with having two certificates on one server, do the ports need to be different in the bindings even if the IP addresses in the bindings are different?
hey ryan, just reading through this post and stumbled across your question & thought I'd post something back to you in case you were still haning out for a solution. It makes sense that you are experiencing this.
Whilst normal http sites listening on port 80 can differentiate the different requests from the http GET information, there can only be one https-encrypted site listening on 443 at a time (essentially becuase it is an IIS application that needs to decrypt the ssl before it can see any the GET request info - and by then it is too late). You'll have to move your second https-enabled site to a different port number or bind another ip address to the box to use 443 with.
(Hope this helps, now i'm off to give this walkthrough a try)
So I configured everything successfully, with one exception, the HTTPS URL is in the internet zone instead of the intranet zone. Now, using HTTPS I can successfully login with the administrator account, but my other user account gets 401 unauthorized. On HTTP both accounts login fine. Any ideas?
When I do this, my first browse of the web site is using HTTPS, but then it converts to the public zone which is still HTTP.
I'm having the same problem as Mike :-(
Thanks, nice post.
I think part of this process is wrong. I may be wrong here...
When you create an Alternate Access Mapping (AAM), you are not actually editing the IIS binding, which is why later you have to go in to IIS and edit your binding (I dont think this is MS best practices).
I think if you extend your web application to the https URL with host header, the AMM and bindings is created for you automatically, and managed through SharePoint.
I didnt read the entire blog, but skimmed so maybe I missed a disclaimer or reason you went to IIS directly for the binding.
Thanks a lot for the information. I am trying to provide a "https" level of access to my sharepoint intranet site. I could able to do dis by adding Alternate Access Mapping and Adding a https binding with port 443 and by attaching valid certificate to my sharepoint site.
I am able to open my site with https. however, when i select any list item check box, th edit, view buttons on ribbon are greyed out. I am not even able to select the ECB/Context menu of list/library items.
don't know where it went wrong. please help me out.
you were a big help to me.
It is an expected behaviour for anonymous users. You have to login to the site to do any contribute level actions. Please look at my latest blog on a related topic.
Eric - yes you were right, we can extend the web application to different zones, that way no need to configure AAM , but still need to configure the certificate in IIS. Also that approach will be good because there will two different w3wp.exe to server each zones.
very helpful and was a sufficiently good guide. Thanks!