How to enable SSL on a SharePoint 2010 web application ?
Hello my friends, I thought that to start blogging about SharePoint 2010 with very basics, like creation of the site with host address that configured in the DC, enable SSL, enable Kerberos authentication etc.
Being a developer we won’t do these configurations regularly but for admin guys it will be a cake walk J
So, let me start with the details of my machine details. I have two machines, first machine is my Domain Controller with Active Directory, I have installed SQL server 2008 with SP1 + CU2 in this machine.
Second machine has SharePoint 2010 Public Beta, Visual Studio 2010 Beta, Office 2010 Beta, SharePoint designer 2010 Beta
Both machines are running with Windows Server 2008 R2 and domain name is “sowmyan.com”
My first task is create a very basic team site with a URL www.sowmyan.com
1. First I am going to enter a host entry in the DNS in my Domain Controller(you can do it even after creating the site, but here I am going to add a new host entry with name “www”, thus the FQDN will be www.sowmyan.com) and pointing it to the IP address of my SharePoint server.
2. Now create a new web application in SharePoint central administration site. While creating the web application specify the port as 80 and host header as www.sowmyan.com, so while accessing the URL it will be neat and no need to specify port number.
3. After creating the web application creating a new site collection at the root.
4. Once the site got created browse to the site and if there is a loop back check then we can’t successfully login to the site, it may prompt for credentials 3 times and will show blank page. To resolve this issue follow the below KB article :
In my environment the issue got resolved after adding the DisableLoopBackCheck entry in the registry settings and a reboot by following the above mentioned KB.
5. Finally here is our site J
Now we will see how we can make our site SSL enabled.
Note: strongly recommend to use Central Administration or PowerShell to extend the web application with port HTTPS instead of doing the manual HOST name entry IIS by adding a new URL in AAM like the below method . Once you get the second IIS website , you can configure the SSL certificate binding in IIS. Specifically with the claim based authentication as the default option in SharePoint 2013 and NTLM deprecated, it is highly recommend to implement the zones using AAM. Also, in 2013 you can implement streamlined topology where a single web application with Host Named Site Collections with the support for zones. When I wrote this post , SharePoint 2010 was on beta stage :)
We can either configure the web application to use SSL whenever we create new web application or extend the web application. In my scenario since I'm going with the manual method (which is not suggested - please follow the above note).
For that I am going to do the following.
1. Go to Alternate Access Mappings: Central Administration à Application Management à Alternate Access Mapping.
2. Select the web application in the right most drop down and click on “Add Internal URLs”
3. Add a new URL with HTTPS, here I have added https://www.sowmyan.com and select a zone, here I have
selected Intranet zone. Then AAM collection will show the list of URLs with zones.
4. Now if we try to browse to the site using https it won’t browse because we have to install the certificate and
configure the website in IIS.
5. If you are not using DNS host entry then can create a self-signed certificate in IIS 7 or get a certificate from a third
party CA and can bind it with your SharePoint website. You can refer the following article for getting more
information about it.
Follow the below TechNet to know more about the “Configuring Server Certificates in IIS 7”
But in my scenario since I am using DNS and thus I can’t use self-signed certificate if the host entry is in DNS. If I use a self-signed certificate I will get a Certificate Error:
For that I have to first add “Active Directory Certificate Service” Role in my Domain Controller. Please follow my post to know how to add that role in Windows 2008 R2.
Now we are ready for the configuration of IIS website for SSL.
1. Double click on “Server Certificates” and it will open the configuration window.
2. On left side it will show the actions, and select “Create Domain Certificate”.
3. It will open the below window and provide the details, but make sure the certificate's "Common Name" (CN) matches the host header in the request, e.g. if the client is making a request to www.contoso.com, then the CN must also be www.contoso.com
4. In the next screen you have to provide the Online Certification Authority details. You have to provide it in a specific format like below ( see the red box)
If you don’t know the certification authority’s name then open the server manager in the DC machine and can find it out under “Active Directory Certificate services”
You may get some error if you didn’t specify the certificate authority name correctly or didn’t import it to the local machine’s trusted certificates folder (how it is done here – last portion)
5. Once it completed successfully you can see the certificates and once you click on the newly created certificate you
can see the details.
6. Next step is create a new binding with HTTPS and use the certificate that we just created.
Create an SSL Binding
Select a site in the tree view and click Bindings... in the Actions pane. This brings up the bindings editor that lets you create, edit, and delete bindings for your website. Click the Add... button to add your new SSL binding to the site.
New bindings default to http on port 80. Select https in the Type drop-down. Select the certificate that we created earlier from the SSL Certificate drop-down and click OK.
Now you have a new SSL binding on your site and all that remains is to verify that works.
Verify the SSL Binding
Look in your site's Actions pane for a link that will browse your site over your new HTTPS binding. Click this link to test your new binding.
Once it is done just browse to your site with https: If everything is fine then you can see a small lock sign in the address bar and once you click on it will give you the details of your certificate and it will say that the connection to the server is encrypted.