HAP on CC4 server, and SSL certificates

[ashleyturner86]

Hi,

 

I'm after some advice about setting up HAP on a CC4 first server, and specifically the SSL certificates.

 

With a standard CC4 FS, the "RM" website already exists, and is bound to TCP 443 - it's used for internal RM stuff (learning resources etc.), and makes use of a self issued SSL certificate.

By adding the HAP content to "D:\RMNetwork\RMManage\Web Components\HAP\", the HAP website can then also use TCP 443. But, unless I'm missing something, that presents a problem with certificates - as you can only have 1 certificate bound to the "RM" website, you must either choose to:

-Replace the existing one with the "proper" SSL one obtained from an online trusted CA (which secures "hap.domainname.co.uk" or similar for HAP access, but then will break learning resources),

-Keep the existing self signed one (which keeps learning resources etc. working, but means the HAP website isn't secured).

 

Have I missed something obvious, or is the above true, and if so, what do others do?

 

Thanks in advanced for any assistance

[Edu-IT]

-Replace the existing one with the "proper" SSL one obtained from an online trusted CA (which secures "hap.domainname.co.uk" or similar for HAP access, but then will break learning resources),

You'd need a multiname SSL. This is what we've done. As long as you secure the server name, as well as hap.domainname.co.uk, then Learning Resources still works.

[ashleyturner86]

You'd need a multiname SSL. This is what we've done. As long as you secure the server name, as well as hap.domainname.co.uk, then Learning Resources still works.

 

Thanks for the pointer. So to do it "properly", I need to create a CSR for a multiname SSL certificate, which includes the external FQDN (hap.domainname.co.uk), and the internal server name (SVR-001)? That being the case, 2 questions:

 

1. How do you create a multiname CSR (the IIS7 GUI doesn't appear to give the option - only lets you specify one CN using the wizard)?

2. Will a public CA provide an SSL certificate which also includes details of an internal server which they can't "verify"? I've read around a bit, and found the following document, which suggests they will, but only for a finite period of time - it seems the general stance on this is changing, and all public CAs won't be able to do this in the future:

https://cabforum.org/Baseline_Requirements_V1.pdf

[Edu-IT]

Thanks for the pointer. So to do it "properly", I need to create a CSR for a multiname SSL certificate, which includes the external FQDN (hap.domainname.co.uk), and the internal server name (SVR-001)? That being the case, 2 questions:

 

1. How do you create a multiname CSR (the IIS7 GUI doesn't appear to give the option - only lets you specify one CN using the wizard)?

2. Will a public CA provide an SSL certificate which also includes details of an internal server which they can't "verify"? I've read around a bit, and found the following document, which suggests they will, but only for a finite period of time - it seems the general stance on this is changing, and all public CAs won't be able to do this in the future:

https://cabforum.org/Baseline_Requirements_V1.pdf

Just create the CSR in IIS7 for hap.yourdoman.co.uk. Then, submit this to the SSL provider and you'll just go in and then add the other domains. They will accept internal server names.

 

I used GoDaddy.

 

I think the thing that is changing is that the primary name (such as hap.mydomain.co.uk) must be able to be verified. You can't use an internal name such as server.schoolname.internal as the primary name on the SSL cert.

[nickbro]

For multi-name certs, if you run exchange it's easiest to use it to generate the csr

 

e.g.

New-ExchangeCertificate -GenerateRequest -KeySize 4096 -SubjectName "c=GB, s=Powys, l=Crickhowell, o=Crickhowell High School, ou=IT, cn=schoolmail.crickhowell-hs.powys.sch.uk" -DomainName autodiscover.crickhowell-hs.powys.sch.uk, folders.crickhowell-hs.powys.sch.uk -PrivateKeyExportable $True

 

https://www.digicert.com/easy-csr/exchange2010.htm

 

You would import it back onto the exchange server, then use certmgr.msc to export it as a PFX with the private key and import it on the IIS server

Edited October 19, 2012 by nickbro

[ashleyturner86]

Hi folks,

 

I managed to generate a CSR using certmgr.msc, and specify the required SANs. However, upon submitting to my SSL provider (JANET - they provide free SSL certificates via Comodo for educational establishments), they've rejected it because of the internal SANs as I feared they would.

 

Have others definitely done this, and obtained an SSL certificate for the external FQDN of the website, as well as having SANs for internal server names etc.? I don't have huge experience with SSL certificates, so I'm not sure if it's an issue with the provider I'm using, or if others would have the same stance.

 

Thanks again,

[Edu-IT]

You won't be able to get them from Janet. Have to use GoDaddy or something.