Eportal Certificate Error

[sniffingmoose]

The school is We are still running CMIS with Eportal. Started getting Certificate Errors when starting Eportal. I had to add an exception on all the Teachers PCs as a workaround.

 

Hoping that there was a permanent fix I logged a call with Advanced Learning. 2 weeks later I got this reply:-

 

Summary: Security Cerfifacate error

Close Reason: Help & Advice

Case Closure Comments: Hi Chris

 

The reason you get this error message is to do with the signed algorithm in the IIS server certificate being SHA1 in which all major browsers have depreciated. Chrome where the first to have done this and IE discontinued that SHA1 algorithm recently.

 

You will need to speak to your supplier of Domain/IIS certificates to give you an updated IIS certificate."

 

I am non the wiser, who is a supplier of Domain/IIS certificates ?

 

Any thoughts

[Marci]

Go to ePortal, view the SSL certificate via the web-browser, it'll tell you the company that issued it (i.e.: where your employers purchased it from). Contact them for a new SHA-2 based certificate.

 

If using a self-generated certificate, then that's done entirely locally on your server, and just needs a new one generating and installing. See https://jetsupport.jetreports.com/hc/en-us/articles/235636308-How-To-Create-a-SHA-256-Self-Signed-Certificate for instance.

[Banjo]

Best way is to self certificate. Advanced should give you a 'how to' on implementing this. From memory it was via a cmd prompt.

[Michael]

As above, there are two considerations -

 

- Firstly the SHA1 algorithm has been depreciated since deploying/installing the May 2017 Microsoft Updates

- Secondly, most/all certificates in Birmingham were issued by Link2ICT and are due to expire next month (end of June 2017)

 

So you have two choices -

 

- If you don't require API or external access to e-Portal, simply change your e-Portal shortcut to read: http://10.x.x.x:8080/eportal/ for all users. Replace the IP with your MIS server's internal IP.

 

- If you do require the API or external access to e-Portal, log a call with Link2ICT for a new certificate. This costed me £35 for 3 years and I requested the certificate to be registered to misportal.schoolname.bham.sch.uk rather than schoolname.misportal.net which Link2ICT will no longer allow schools to use.

 

To do this, on your MIS server launch IIS, highlight the server name (at the top of the left column), double click Server Certificates (in the middle), then on the right select 'Create Certificate Request'

 

In the Common Name field, specify misportal.schoolname.bham.sch.uk then fill out the other fields as appropriate.

 

Leave the service provider as Microsoft RSA and change the bit length to 2048 bit.

 

Send the TXT file to Link2ICT. In the meantime, create an alias such as [email protected] rather than your real e-mail address to receive the T and C's for the certificates.

 

Once you receive the certificates, in the same place as above, select 'Complete Certificate Request' locate the file and specify misportal.schoolname.bham.sch.uk as the friendly name.

 

On the left select 'Default Web Site' then on the right select 'Bindings'. Select https, choose 'Edit' and select misportal.schoolname.bham.sch.uk from the drop down list. Click 'OK' and then 'Close'.

 

Now select 'HTTP Redirect' and change the URL from https://schoolname.misportal.net/eportal to https://misportal.schoolname.bham.sch.uk/eportal

 

As a recommendation, restart IIS and restart Facility/e-Portal services. Now change/update user shortcuts to read https://misportal.schoolname.bham.sch.uk/eportal

 

That's it for another 3 years!

[Michael]

Self signed certificates for the purpose of 'talking' to an external provider won't work as it won't be trusted. A real certificate from a CA is required for this and for the sake of £35 for three years, I really don't see it as a problem.

[sniffingmoose]

Thanks for your replies everyone, it all sounds a hassle to me. The management say "why do we have to pay £35 every 3 years when we pay large annual licensing costs for facility & Eportal" So for a quiet life I will just create an exception on every teachers PC. Only 18 PCs to do!

[Achandler]

If you already have a certicate, which seems likely since your now getting an error. You should be able to request a SHA-2 version for free, every supplier we use allows us to.

[Michael]

Well the alternative (if requiring external API access), is the data is submitted insecurely. Definitely not a good idea.

 

Paying for an SSL cert is perfectly normal for every company, school or charity globally. As to whether Advanced Learning should provide an SSL certificate at their cost is a different discussion altogether.

 

They do of course do this for Progresso, but they're buying one certificate for all customers.

[Michael]

If you already have a certicate, which seems likely since your now getting an error. You should be able to request a SHA-2 version for free, every supplier we use allows us to.

 

Link2ICT could do this, however it would be based on the current lifecycle of the existing certificate (ending end of June 2017). This is their decision. To be honest, it's all a bit political, but so long as you make a decision on how to proceed (suppressing the certificate warning), then it doesn't matter.

[pete]

Thanks for your replies everyone, it all sounds a hassle to me. The management say "why do we have to pay £35 every 3 years when we pay large annual licensing costs for facility & Eportal" So for a quiet life I will just create an exception on every teachers PC. Only 18 PCs to do!

 

Because they can't say they're doing everything they can to protect pupil data if they're quibbling over £35 to secure the transmission of said data.

 

This is one of those occasions where it's your job as IT to protect management from themselves.