tj2419 Posted August 14, 2014 Posted August 14, 2014 Hi I set up HAP recently and had it running on a server signed certificate for a while whilst testing it. That worked but you needed to click confirm past the security warning. I have now set it up with an external URL and a free certificate from startssl. This works externally fine but i still cannot access it internally without the certificate warning. Externally i access it using https://hap.schoolname.co.uk If i try this address in work it just fails to load. Any ideas? I think i have missed something as it's my first time playing around with SSL certificates and IIS. Cheers
fairm010 Posted August 14, 2014 Posted August 14, 2014 You need to create a reverse lookup zone in DNS called "school name.co.UK" then create an A record of "HAP" pointing to your web servers internal IP. I did this and it works great. Let me know if you have any trouble. Matt
tj2419 Posted August 14, 2014 Author Posted August 14, 2014 You need to create a reverse lookup zone in DNS called "school name.co.UK" then create an A record of "HAP" pointing to your web servers internal IP. I did this and it works great. Let me know if you have any trouble. Matt Hi Would that need to be done on my IIS server or via names.co.uk? If you have anymore detailed steps they would be greatly appreciated
nickbro Posted August 14, 2014 Posted August 14, 2014 What is the error message that's coming up, the domain name doesn't match, or it doesn't trust startssl? It's it's the latter then you need to update your root certificates
fairm010 Posted August 14, 2014 Posted August 14, 2014 It needs to be done on your internal DNS servers on your network. If you need more detailed instructions I'll hop on a PC soon. 1
Foresthippy Posted August 14, 2014 Posted August 14, 2014 Could also need proxy exceptions, assuming you have an upstream proxy. The easiest way to test this is to disable the proxy settings in your browser and try the HAP server via its IP - i.e. https://192.168.0.200/hap or whatever your server IP is.
tj2419 Posted August 14, 2014 Author Posted August 14, 2014 Could also need proxy exceptions, assuming you have an upstream proxy. The easiest way to test this is to disable the proxy settings in your browser and try the HAP server via its IP - i.e. https://192.168.0.200/hap or whatever your server IP is. Hi I can access the server via the IP address. But it still comes up with the certificate warning whether using the startssl certificate (as it is issued to schoolname.co.uk). Is there anyway to prevent the certificate warning when accessing via IP for computers on the domain? Thanks
fairm010 Posted August 14, 2014 Posted August 14, 2014 To not see the certificate warning the URL must match the certificate. If you go down the DNS route you wont see it.
tj2419 Posted August 14, 2014 Author Posted August 14, 2014 Do you have any more detailed steps on how to do it via DNS? Thanks
Foresthippy Posted August 14, 2014 Posted August 14, 2014 This suggests that you need a proxy exception for the fully qualified DNS name of the server, as you would access it in the browser, in addition to some local DNS stuff mentioned by others. I only suggested using the IP for testing purposes. You can add the exceptions for everyone using whatever method you use to distribute proxy settings to clients.
fairm010 Posted August 14, 2014 Posted August 14, 2014 1) Go to your primary DNS server (Normally your DC) 2) Open DNS and create a new Primary zone under forward lookup zones to all DNS Servers. 3) Call it under zone name schoolname.co.uk 4) Create an A record in that zone called HAP and point it to your IIS servers IP. 5) Give it a while to propagate (5 mins) and try browsing to the site. If you ping HAP.schoolname.co.uk internally it should reply with your IIS servers IP.
tj2419 Posted August 21, 2014 Author Posted August 21, 2014 Right, i can access the site internally via the URL now. But for some reason still getting a certificate warning :S Same URL externally, no problems. Any ideas?
fairm010 Posted August 21, 2014 Posted August 21, 2014 Are you sure that the URLs match exactly? Subdomains and all?
tj2419 Posted August 21, 2014 Author Posted August 21, 2014 Are you sure that the URLs match exactly? Subdomains and all? Yes, i am using a shortcut that is on our VLE that people currently use outside of school. https://hap.schoolname.co.uk/hap
fairm010 Posted August 21, 2014 Posted August 21, 2014 Huh, odd. Is is a self signed cert or paid for?
tj2419 Posted August 21, 2014 Author Posted August 21, 2014 It was a free one from startssl https://www.startssl.com/
fairm010 Posted August 21, 2014 Posted August 21, 2014 I dunno man, sorry. All my certs are paid for from our Domain Reg.
tj2419 Posted August 21, 2014 Author Posted August 21, 2014 I dunno man, sorry. All my certs are paid for from our Domain Reg. Alright, thanks for your help anyway
tj2419 Posted September 1, 2014 Author Posted September 1, 2014 What is the error message that's coming up, the domain name doesn't match, or it doesn't trust startssl? It's it's the latter then you need to update your root certificates @nickbro Hi Nick, I have it working so that the URL now works in school and outside of school. But when i school it gives a certificate error. Outside of school it works fine. This is using the exact same URL via a shortcut on our VLE. The error says "This certificate cannot be verified up to a trusted certification authority" Any advice would be great thanks. I really want to use the room bookings this year.
tj2419 Posted September 1, 2014 Author Posted September 1, 2014 1) Go to your primary DNS server (Normally your DC) 2) Open DNS and create a new Primary zone under forward lookup zones to all DNS Servers. 3) Call it under zone name schoolname.co.uk 4) Create an A record in that zone called HAP and point it to your IIS servers IP. 5) Give it a while to propagate (5 mins) and try browsing to the site. If you ping HAP.schoolname.co.uk internally it should reply with your IIS servers IP. @fairm010 I have just noticed it seems to work on my DC now fine but still has the security warning on the other desktops in the school. Is there a way to force the DNS update out to the other machines? Cheers
fairm010 Posted September 1, 2014 Posted September 1, 2014 Do all your clients point to your DC as their primary DNS server?
tj2419 Posted September 1, 2014 Author Posted September 1, 2014 Yes it is. Just tried recreating it. When you create it it gives me an option for To all DNS servers running on domain controllers in this forest To all DNS servers running on domain controllers in this domain To all DNS servers running in this domain (for windows 2000 compatibility) Which one should i use? Thanks
fairm010 Posted September 1, 2014 Posted September 1, 2014 All DNS Servers in the forest but that is not what I need to you to check. In DHCP Scope options what do you have set for DNS servers? If you go to a client and open a command and do ipconfig /all what is listed under DNS Servers? It should be the IP of your DC.
tj2419 Posted September 1, 2014 Author Posted September 1, 2014 All DNS Servers in the forest but that is not what I need to you to check. In DHCP Scope options what do you have set for DNS servers? If you go to a client and open a command and do ipconfig /all what is listed under DNS Servers? It should be the IP of your DC. Hi under DNS it says 10.24.80.51 10.24.80.52 10.24.80.53 10.24.80.50
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now