"This page isn't working right now" ERR_EMPTY_RESPONSE in IIS but it does not make sense.

Question

"This page isn't working right now" ERR_EMPTY_RESPONSE in IIS but it does not make sense.

Hunter Glod 0

I'm a Sales Engineer who manages our environment for Sales Demos for our company's software. Currently I am having issues within IIS when navigating to web pages via hostname of the server. Let me explain some background first:

The environment is composed of a VM in Azure, with an internal VM that lives on the Azure VM in Hyper-V. This internal VM is where IIS and our software is installed. All network traffic is forwarded from this external VM to the internal VM.
The Azure VM has a hostname of hostname.cloudapp.azure.com for example and the internal VM has a hostname of DEMOMASTER for example.
IIS has a Default Web Site which our software uses that is pointed at all the webpages in C:*SoftwareName*\Webs of DEMOMASTER.
This past year, I had to create a new SSL certificate for the server because I had to add some DNS names to the certificate for different aspects of how our software functions or I would get a certificate error. I had just created a self-signed certificate since this is a single host used solely for sales demos so I didn't see the point in purchasing a proper certificate from a big-name CA. I did so using the following PowerShell command in the code block below.
I have this certificate bound to port 443 in IIS for the Default Web Site. This certificate is also installed in the Personal store of the server for the computer account, as well as in the Trusted Root of my Demo Consultants for their user accounts.
We connect to this site by adding a DNS entry in our Windows host file.

Finally, onto my problem with some IIS website examples and errors:

When browsing to https://hostname.cloudapp.azure.com/idp for example, the site loads fine and has a trusted certificate as expected.
When browsing to https://DEMOMASTER/idp, I get the following error.
When opening Fiddler Classic, and capturing web traffic, and browsing to https://DEMOMASTER/idp, it loads fine.
I cannot change the url to http://DEMOMASTER/idp, it automatically defaults to https://DEMOMASTER/idp even though I have Require SSL disabled in IIS for the Default Web Site under SSL Settings.
I added another DNS hosts entry (test) pointed at the same IP address for troubleshooting and threw a .asp file in the C:*SoftwareName*\Webs folder. I can browse to http://test/test.asp fine however trying to load https://test/test.asp, http://DEMOMASTER/test.asp and https://DEMOMASTER/test.asp, I get the same error as above.

I have spent months trying to Google and read up on this, contacted various coworkers (who all don't know) and I have run out of ideas. I have hit a point in the new version of our software for sales demos that this HAS to be resolved. The fact that I can open Fiddler, capture web traffic, and everything loads as expected is making me believe something is wrong with my SSL certificate somehow and Fiddler is decrypting the SSL traffic for me in a better way. If anyone has any ideas, I am open to trying them.

Thank you for taking the time to read this.

New-SelfSignedCertificate -Subject "DEMOMASTER" -NotAfter (Get-Date).AddMonths(360) -TextExtension @("2.5.29.17={text}DNS=DEMOMASTER&DNS=hostname.cloudapp.azure.com&IPAddress=*externalIP*&IPAddress=::1")

Prrudram-MSFT 28,366 Reputation points Microsoft Employee Moderator

2023-03-29T05:11:17.41+00:00

Hi @Hunter Glod

Checking in to see what the progress is here? Did you get a chance to see the last comment from @MotoX80

1 answer

Your answer

Prrudram-MSFT 28,366 Reputation points Microsoft Employee Moderator

2023-03-29T05:11:17.41+00:00

Hi @Hunter Glod

Checking in to see what the progress is here? Did you get a chance to see the last comment from @MotoX80

Answer 1

MotoX80 36,401

I created a cert using your command (with a dummy externalIP address) and added it to my default web site. I removed the HTTP binding to the site. I tried browsing the site from my main laptop and got the expected certificate warning. But I was able to click on the "proceed at your own risk" warning and the page came up.

Then on the web server (a test Win10 VM) I exported the cert without he private key. Then I followed these instructions to import it into the Trusted Root Certification Authorities on the laptop.

https://www.ntweekly.com/2020/08/31/make-a-self-signed-certificate-trusted-on-windows/

The site then came up just fine with no warnings.

User's image

My hosts file has this entry.

192.168.1.2 demomaster

IIS bindings look like this.

User's image

Is the time of day clock on all machines correct? Have you double checked to see that your hosts file has the correct IP address?

Check the application and system eventlogs on the server. Also check the IIS logs and the HTTP error logs in C:\Windows\System32\LogFiles\HTTPERR.

Fiddler is doing a "man in the middle" intercept. Try hitting F12 in the browser and select the Network tab and see if that shows anything different (without Fiddler).

Hunter Glod 0 Reputation points

2023-03-14T13:27:17.0533333+00:00

I noticed you said you exported the certificate without the private key. This is different from what I've done. In doing so however, I get the same result and error.

Application and system logs within event viewer give me nothing unfortunately.

I had found those logs at C:\Windows\System32\LogFiles\HTTPERR, nothing there either.

This server is central time, I am in eastern time, however I have coworkers on my team in central time that see the same error.

And in regards to the SSL certificate binding, I have the correct certificate bound to 443. I can verify this by opening the same sites by IP address and can view the same certificate.
MotoX80 36,401 Reputation points

2023-03-14T15:30:07.39+00:00

Maybe some TLS version mismatch.

Try this script.

http://blog.whatsupduck.net/2014/10/checking-ssl-and-tls-versions-with-powershell.html

Also see this post.

https://stackoverflow.com/questions/42202422/check-website-is-tls-or-ssl-and-its-version

IIS Crypto is a good tool. Maybe that will show something.

https://www.nartac.com/Products/IISCrypto/

Hunter Glod 0

This the output from that script. Everything here appears ok from what I know.

ComputerName       : 20.225.203.35
Port               : 443
KeyLength          : 2048
SignatureAlgorithm : sha256RSA
Ssl2               : False
Ssl3               : False
Certificate        : [Subject]
                       CN=plapvsvpodemo

                     [Issuer]
                       CN=plapvsvpodemo

                     [Serial Number]
                       72C3488751227AB0429490A3E1886C90

                     [Not Before]
                       10/6/2022 8:38:24 AM

                     [Not After]
                       10/6/2052 8:48:24 AM

                     [Thumbprint]
                       6FE3D3955EEC5EA6406B5CB334E872A3CDF36570

Tls                : True
Tls11              : True
Tls12              : True
Tls13              : False

MotoX80 36,401

The names need to match, Is plapvsvpodemo a different cert? Or a different site?

Use the same name like this.


PS C:\Utils> .\Test-SslProtocols -ComputerName demomaster


ComputerName       : demomaster
Port               : 443
KeyLength          : 2048
SignatureAlgorithm : sha256RSA
Ssl2               : False
Ssl3               : False
Certificate        : [Subject]                                                                                                                 CN=DEMOMASTER                                                                                                                                                                                                                                 [Issuer]                                                                                                                  CN=DEMOMASTER

                     [Serial Number]
                       3AAF6FCCAC03A3A44E41B7B3BB7DB436

                     [Not Before]
                       3/13/2023 5:55:14 PM

                     [Not After]
                       3/13/2053 6:05:14 PM

                     [Thumbprint]
                       5808A6EA202D0307375CC3FDE6FF70044956C885

Tls                : True
Tls11              : True
Tls12              : True
Tls13              : False



PS C:\Utils> Invoke-WebRequest https://demomaster


StatusCode        : 200
StatusDescription : OK
Content           : <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
                    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
                    <html xmlns="http://www.w3.org/1999/xhtml">
                    <head>
                    <meta http-equiv="Content-Type" cont...
RawContent        : HTTP/1.1 200 OK
                    Accept-Ranges: bytes
                    Content-Length: 696
                    Content-Type: text/html
                    Date: Thu, 16 Mar 2023 14:40:40 GMT
                    ETag: "81145aef655d91:0"
                    Last-Modified: Mon, 13 Mar 2023 21:56:35 GMT
                    Server...

Share via

"This page isn't working right now" ERR_EMPTY_RESPONSE in IIS but it does not make sense.

1 answer

Your answer