Re: Securing Webservice

Hi Joe,
Thanks for your reply.

The problem apppears to be that I am not installing the certificate on the
client successfully.
When the browser brings up the Certificate question dialog box I go down the
view certificate -> install certificate path. This seems to proceed
correctly.
I have tried letting the wizard choose where to put the certificate as well
as taking the manual path and selecting Trusted Root Certicate Store. In
both cases I am told the import is successful.

However a new browser window gets the certificate question and away we go
again.

The goal is to deploy a thick client on a couple of external machines.

My test Http deployment went OK. but now I have clamped down to Https the
newly installed test app errors trying to connect.

I am assuming that the inability of the browser to repeatedly use the
certificate is related but this may not be correct as the app has been told
to trust any certificate. Still, it is a starting point to trying to figure
out what is wrong.

Thanks
Bob

"Joe Kaplan" <joseph.e.kaplan@xxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:uooZrOaHHHA.420@xxxxxxxxxxxxxxxxxxxxxxx
The issue here is that your browser doesn't trust the certificate. IE
isn't
installing a certificate when it gives you a warning, it is just telling
you
it doesn't trust the certificate. In order to get the client to trust it,
you need to put the root certificate in the client's root certificate
store.

Note that you'll need to do that for every client that will access the
server. If that is a lot of clients, you might want to consider a
certificate from a public CA. If they are all members of your domain,
then
you can deploy an enterprise CA to get that root automatically installed
on
each domain member.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services
Programming"
http://www.directoryprogramming.net
--
"Bob" <bob@xxxxxxxxxxx> wrote in message
news:O$qmzYYHHHA.1240@xxxxxxxxxxxxxxxxxxxxxxx
Hi,
I am new to web admin and security.
Made a certificate server out of the development Win2k server and
created
a
root certificate.
The same machine is also the web server for now.
Updated the Web site directory properties to require SSL
When I query the site from a browser on the LAN it brings up the
certificate
question and the certificate install appears to go OK. The WSDL doc for
my
service then appears
However if I start a new browser window it asks the certificate question
again.

Any clues as to where I am going wrong?
thanks
Bob






.

Relevant Pages

  • RE: OWA, IIS and SSL
    ... certificate on to an external workstation that has IE ... >I've come across another error on the client side. ... >select browser type, which does NOT include IE5.5 or 6, ... >>>When a client computer that is running Microsoft ...
    (microsoft.public.inetserver.iis.security)
  • RE: OWA, IIS and SSL
    ... I've come across another error on the client side. ... select browser type, which does NOT include IE5.5 or 6, ... appears before the Certificate Enrollment Form box appears. ... >error that https was required so I presume my server side ...
    (microsoft.public.inetserver.iis.security)
  • Re: How to starthandshake with client browser??
    ... >> And then what should i do to handshake with browser? ... > getting the browser to trust your certificate. ... 1-Open an SSL server Socket ... 2-Wait for a connection (from your client web browser). ...
    (comp.lang.java.programmer)
  • Re: Securing Webservice
    ... First secure the transmission from the client using https. ... Co-author of "The .NET Developer's Guide to Directory Services ... When the browser brings up the Certificate question dialog box I go down ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: username and Password sent as clear text strings
    ... I don't believe a certificate was every presented to the browser, I'll double check that when I get on the client site this morning. ... I completed a security review of a web server, ... Webscarab, like all intercepting web proxy programs I've used on ...
    (Pen-Test)