Why we need SSL Certificates for configuring App Server in Sharepoint

Hi Support,
We are planning to have a separate server for Apps, while configuring the server its asking for certificate. The main scenario is while configuring server inside the same firewall why we need SSL for configuring.
Could you please let me know the reason why we need SSL for configuring App Server.
Thanks in Advance,
Regards,
Pradeep

Hi Pradeep,
SSL (Secure Sockets Layer) is a transaction security standard that provides encrypted protection between browsers and App Servers. When SSL is enabled for an App Server, browsers communicate with the App
Server by means of an HTTPS connection, which is HTTP over an encrypted Secure Sockets Layer. HTTPS connections are widely used by banks and web vendors for secure transactions over the web.
Secure Sockets Layer is a requirement for web applications that are deployed in scenarios that support server-to-server authentication and app authentication. This is such a scenario. As a prerequisite
for configuring Task Synchronization, the computer that is running SharePoint Server must have SSL configured.
Reference:
http://blogs.technet.com/b/speschka/archive/2012/09/03/planning-the-infrastructure-required-for-the-new-app-model-in-sharepoint-2013.aspx
http://corypeters.net/2013/03/ssl-and-sharepoint-2013/
Best Regards,
Eric
Eric Tao
TechNet Community Support

Similar Messages

Install SSL certificate for Oracle HTTP server

I received a PFX file that contains an SSL wildcard certificate for our company *.xyz.com.
I used this tool "xca" to extract two files: "server.crt" and "serverkey.pem".
I want to install this on the oracle 11g HTTP server (OHS) installed as standalone based on apache 2.2
With oracle, i have to create a wallet and point the SSL.CONF wallet directive to use that wallet.
I used Oracle Wallet Manager to create it and import the certificate but this is where i am having a problems.
First I could not restart the web server but the it worked but I got SSL handshake errors (Shown below).
According to oracle steps, I have to create a CSR and then import the certificate into the wallet
http://www.apache.com/resources/how-to-setup-an-ssl-certificate-on-apache/
However, when I tried to use Oracle Wallet Manager, there were two options: import server certificate and trusted certificate.
The import server certificate was greyed out. I had to create a CSR just to get it enabled but I did not use the CSR, i just imported the "server.crt" file.
I also tried to import the "serverkey.pem" into the trused certificate option but was rejected (invalid certificate).
Do you know how to create a successful wallet based on the files i have and not creating a CSR since i already have a certificate file?
2013-05-04T20:11:40.2718-04:00] [OHS] [ERROR:32] [] [core.c] [host_id: ptp.xyz.xom] [host_addr: 10.72.11.211] [pid: 11339] [tid: 1253263680] [user: root] [VirtualHost: ptp.xyz.xom:443] nzos handshake error, nzos_Handshake returned 29040(server ptp.xyz.xom:443, client 10.60.117.121)
[2013-05-04T20:11:40.2719-04:00] [OHS] [ERROR:32] [] [core.c] [host_id: ptp.xyz.xom] [host_addr: 10.72.11.211] [pid: 11339] [tid: 1253263680] [user: root] [VirtualHost: ptp.xyz.xom:443] NZ Library Error: Unknown error
[2013-05-04T20:11:40.4774-04:00] [OHS] [ERROR:32] [] [core.c] [host_id: ptp.xyz.xom] [host_addr: 10.72.11.211] [pid: 11339] [tid: 1263753536] [user: root] [VirtualHost: ptp.xyz.xom:443] unusably short session_id provided (0 bytes)
[2013-05-04T20:11:40.4776-04:00] [OHS] [ERROR:32] [] [core.c] [host_id: ptp.xyz.xom] [host_addr: 10.72.11.211] [pid: 11339] [tid: 1263753536] [user: root] [VirtualHost: ptp.xyz.xom:443] nzos handshake error, nzos_Handshake returned 29040(server ptp.xyz.xom:443, client 10.60.117.121)
[2013-05-04T20:11:40.4776-04:00] [OHS] [ERROR:32] [] [core.c] [host_id: ptp.xyz.xom] [host_addr: 10.72.11.211] [pid: 11339] [tid: 1263753536] [user: root] [VirtualHost: ptp.xyz.xom:443] NZ Library Error: Unknown error
[2013-05-04T20:11:40.6814-04:00] [OHS] [ERROR:32] [] [core.c] [host_id: ptp.xyz.xom] [host_addr: 10.72.11.211] [pid: 11339] [tid: 1274243392] [user: root] [VirtualHost: ptp.xyz.xom:443] unusably short session_id provided (0 bytes)
[2013-05-04T20:11:40.6816-04:00] [OHS] [ERROR:32] [] [core.c] [host_id: ptp.xyz.xom] [host_addr: 10.72.11.211] [pid: 11339] [tid: 1274243392] [user: root] [VirtualHost: ptp.xyz.xom:443] nzos handshake error, nzos_Handshake returned 29040(server ptp.xyz.xom:443, client 10.60.117.121)
[2013-05-04T20:11:40.6816-04:00] [OHS] [ERROR:32] [] [core.c] [host_id: ptp.xyz.xom] [host_addr: 10.72.11.211] [pid: 11339] [tid: 1274243392] [user: root] [VirtualHost: ptp.xyz.xom:443] NZ Library Error: Unknown error

I do not have weblogic installed. I only have standalone 11g HTTP server with mod_plsql.
If i can get OWM working to create a successful certificate them the problem would be resolved.
I am just not sure what is Root Certificate and Trustworthy Certificate and how to get that from the files i have.

Ssl certificates for a clustered environment

Hi all,
I have a rather large domain in one environment with one Admin Server and 6 Managed Servers.
The Managed Servers are split on two physical machines with the first machine holding the Admin Server as well.
Each pair of servers is joined in a cluster, so I have 3 clusters, each hosting one application.
Now some of the communication needs to be done over ssl and I'm wondering about the configuration. First of all I should
note that these certificates won't be seen by a client (browser), they will only be used for internal application communication.
So, do I need one certificate for each managed server for his identity keystore? Or can I use the same certificate for all of them?
They will all be accessible under the same url, under a couple of layers of routers. If I use the same certificate can I use the one on the
router, which the clients see as well? Can I or Must I?

You only need to tell nodemanager where to find its certs. If you've already chosen SSL for your nodemanager, then by default it uses the democerts that come with WL. But you really don't want to use those...
So in your nodemanager properties, use something like:
# SSL Configuration
KeyStores=CustomIdentityAndJavaStandardTrust
CustomIdentityAlias=your_cert_alias
CustomIdentityKeyStoreFileName=full_path_to_your_identity_keystore_used_by_your_mgd_server
CustomIdentityKeyStorePassPhrase=your_storepass
CustomIdentityKeyStoreType=jks
CustomIdentityPrivateKeyPassPhrase=your_keypass
This tells your nodemanager to use the same identity as your managed servers. Since it's using java standard trust, it shares the same "cacerts" as the app server. In the console, your Machine -> Configuration -> Node Manager -> Type would be SSL.
So that would be all that's required for the nodemanager.
In your trust keystore, you can just add the signer / root ca cert for your certs, or you can add the individual server certs if you want to restrict the trust a little further. Normally identity certs expire more frequently than root certs, so I don't put identity certs into the trust store since it just means more maintenance when they expire.

Wildcard * SSL Certificates for TTA??

Is there any way I can use a wildcard SSL certificate like:
*.mycompany.com
in my TTA server?
I was able to run all the cert commands successfully using the
*.mycompany.com cert:
Generated the CSR (tarantella security certrequest)
Installed the Cert File (tarantella security certuse)
Installed the Chained CA cert (tarantella security customca)
Review/validate certinfo (tarantella security certinfo)
The TTA-installed Apache webserver was fine with the wildcard certificate
since I was able to goto:
https://subdomain.mycompany.com (FYI, the subdomain is NOT "www")
But after I went to:
https://subdomain.mycompany.com/tarantella/
I got the following errors in my Java Console:
Secure Global Desktop 4.10.903: Connecting to Secure Global Desktop
server...
Secure Global Desktop 4.10.903: Using secure connection to
Secure Global Desktop server subdomain.mycompany.com:443
Secure Global Desktop 4.10.903: Certificate (*.mycompany.com) not accepted
for this Secure Global Desktop server (subdomain.mycompany.com) due to name
mismatch.
Secure Global Desktop 4.10.903: Client dropping connection.
Secure Global Desktop 4.10.903: Unable to connect: Certificate
(*.mycompany.com) not accepted for this Secure Global Desktop server
(subdomain.mycompany.com) due to name mismatch.
Secure Global Desktop 4.10.903: Missing negotiation feature cgi script
Is there a way that I can get the applet to do a regex-ish match on the name
for wildcard certs?
Cyrus

Hi Cyrus
I was loosely referring to PKI rules e.g.
http://www.ietf.org/proceedings/98mar/98mar-edited-110.htm
http://www.iihe.ac.be/internal-report/1997/stc-97-19.html
Wildcarding isn't supported. I understand what you are trying to do now
but it won't work because the software is looking for a certificate
matching a single server.
The certrequest command is just a wrapper script for openssl so it won't
stop you doing anything the openssl command believes may be valid. You don't
actually need to use this command it's just there for convenience, you
could do everything just using openssl.
The current documentation doesn't explictly state that you can't use
wildcards in certificates but it does say you need a certificate for a
SGD server. My understanding of the wildcard issue is that it is up to
a particular application to decide what is appropriate.
http://www.tarantella.com/support/documentation/sgd/ee/4.1/help/en-us/tsp/gettingstarted/whatare_certs.html
Regards
Barrie
On 2005-08-15, Cyrus Mehta <[email protected]> wrote:
May I inquire as to where these rules are listed regarding SSL Certs, I
didn't see anything to the effect in the documentation. Also why weren't
the rules enforced at certificate generation time. Even the validation
command (tarantella security certinfo) had no problems.
The CSR generation/signing went through flawlessly and created a wildcard
cert that Apache could use. It's one thing if the whole cert process
couldn't handle a wildcard, but it seems like everything would have worked
if only the applet accepted a wildcard regex match.
Regards,
Cyrus
barrie wrote:
Hi Cyrus
No, sorry. The rules say you can't do that. You are required to have a
certificate for a node not a network.
Regards
Barrie
On 2005-08-05, CM <[email protected]> wrote:
Is there any way I can use a wildcard SSL certificate like:
*.mycompany.com
in my TTA server?
I was able to run all the cert commands successfully using the
*.mycompany.com cert:
Generated the CSR (tarantella security certrequest)
Installed the Cert File (tarantella security certuse)
Installed the Chained CA cert (tarantella security customca)
Review/validate certinfo (tarantella security certinfo)
The TTA-installed Apache webserver was fine with the wildcard certificate
since I was able to goto:
https://subdomain.mycompany.com (FYI, the subdomain is NOT "www")
But after I went to:
https://subdomain.mycompany.com/tarantella/
I got the following errors in my Java Console:
Secure Global Desktop 4.10.903: Connecting to Secure Global Desktop
server...
Secure Global Desktop 4.10.903: Using secure connection to
Secure Global Desktop server subdomain.mycompany.com:443
Secure Global Desktop 4.10.903: Certificate (*.mycompany.com) not accepted
for this Secure Global Desktop server (subdomain.mycompany.com) due to
name
mismatch.
Secure Global Desktop 4.10.903: Client dropping connection.
Secure Global Desktop 4.10.903: Unable to connect: Certificate
(*.mycompany.com) not accepted for this Secure Global Desktop server
(subdomain.mycompany.com) due to name mismatch.
Secure Global Desktop 4.10.903: Missing negotiation feature cgi script
Is there a way that I can get the applet to do a regex-ish match on thename
for wildcard certs?
Cyrus

How we can get SSL certificate for any site?

i want to know how can get SSL certificate for any website and what is the main benefit for particular website with the help of this certificate.

Hi,
Would you please let me know edition information of the SBS server? Was it SBS 2008 or SBS 2011?
Based on your description, I’m a little confused with your question. Did you mean that want to know why need
SSL certificate for website?
Certificate Services and SSL protect sensitive information by encrypting the data sent between client browsers
and your server.
An SSL Certificate is used for two reasons (1) to validate the remote server to the client before the client sends any data to that server (2) to encrypt the data between the client and server over an un-secure network (ie. the Internet). You can use
a self-issued certificate or a third-party trusted certificate. For more details, please refer to following articles and check if can help you.
Managing Certificates
SSL and Certificates
Understanding Self-Issued
Certificates in SBS 2003 & SBS 2008
Installing a GoDaddy Standard
SSL Certificate on SBS 2008
Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft
does not guarantee the accuracy of this information.
If anything I misunderstand or any update, please don’t hesitate to let me know.
Hope this helps.
Best regards,
Justin Gu

Is it possible to use single ssl certificate for multiple server farm with different FQDN?

Hi
We generated the CSR request for versign secure site pro certificate
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
SSL Certificate for cn=abc.com considering abc.com as our major domain. now we have servers in this domain like www.abc.com, a.abc.com , b.abc.com etc. we installed the verisign certificate and configured ACE-20 accordingly for ssl-proxy and we will use same certificate gerated for abc.com for all servers like www.abc.com , a.abc.com , b.abc.com etc. Now when we are trying to access https//www..abc.com or https://a.abc.com through mozilla , we are able to access the service but we are getting this message in certfucate status " you are connected to abc.com which is run by unknown "
And the same message when trying to access https://www.abc.com from Google Chrome.
"This is probably not the site you are looking for! You attempted to reach www.abc.com, but instead you actually reached a server identifying itself as abc.com. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of adgate.kfu.edu.sa. You should not proceed"
so i know as this certficate is for cn=abc.com that is why we are getting such errors/status in ssl certficate.
Now my question is
1. Is is possible to remove above errors doing some ssl configuration on ACE?
2. OR we have to go for VerisgnWildcard Secure Site Pro Certificate for CSR generated uisng cn =abc.com to be installed on ACE and will be used for all servers like www.abc.com , a.abc.com etc..
Thanks
Waliullah

If you want to use the same VIP and port number for multiple FQDNs, then you will need to get a wildcard certificate. Currently, if you enter www.abc.com in your browser, that is what the browser expects to see in the certificate. And right now it won't beause your certificate is for abc.com. You need a wildcard cert that will be for something like *.abc.com.
Hope this helps,
Sean

Installing an SSL certificate for a CSS 11503

I'm having the hardest time searching for clear instructions on how to request and install an SSL certificate for a CSS 11503 Content Switch. Can anyone help or point me in the right direction?
I'm also looking for instructions on how to replace an SSL certificate once it's been installed. Thanks!

Allen,
The portion of the configuration guide related to SSL certificates and keys can be found here:
http://cisco.com/en/US/products/hw/contnetw/ps792/products_configuration_guide_chapter09186a00801eea82.html#1422544
To replace an SSL certificate, you'll need to remove the current certificate and re-import/create the new one.
~Zach

SSL Certificates for installing SharePoint 2013

How many SSL certificates do we need in order to install SharePoint in a production farm?
We are planning to have OWA server farm, a workflow farm and APPS.
V

You need to plan what URL you will have which will work on https. below are few examples
1. Your OWA is recemmonded for https:
2. If you want your SharePoint site then it can also be on SSL
3. If your site on SSL then your apps URL should also be on SSL or might face some issue(assumption)
Here you can purchase a Wildcard certificate(*.domainame.com) then only 1 certificate will surfice all needs
Or
You will need to but a different SSL for each URL. Major problem will be on every app will have a different URL with GUID so you cannot buy a different certificate for each APP.

I'm trying to download a FREE app on my iphone4s and the billing information thing keeps popping up. It wasn't doing that yesterday. What should I do? Idk why I need that info when the app is free

I'm trying to download a FREE app and the billing info thing keeps popping up. It wasn't doing that yesterday. Now I can't even download anything. What should I do ? Idk why I need thus info when the app is free

You must have a payment method in your iTunes account, even for free content. It is used to verify your identity. See: http://support.apple.com/kb/HT2534 for information on how to create a billing method if you don't have a credit card.

HT5622 why is need credit card for my id

why is need credit card for my id to conect with itune
your id has not been used with itune

Hello, Tayub Amin.
Thank you for visiting Apple Support Communities.
To create an Apple ID without a credit or debit card, there is a specific series of steps that have to be processed in order to allow the payment to be set as none on creation of the account.
Creating an iTunes Store, App Store, iBooks Store, and Mac App Store account without a credit card
http://support.apple.com/kb/HT2534
If the specific steps have not been processed, a credit or debit card will be required to complete the setup the account.
However, it can be removed and payment method changed to none as long as there is not an outstanding balance.
iTunes Store: Changing account information
http://support.apple.com/kb/ht1918
Hope that helps,
Jason H.

Upgrade SSL Certificate for Exchange Server

Hi Folks,
I need to upgrade the SSL certificate on my Exchange Server, so he can negotiate encryption and authorization to an upstream SMTP Smart Host. This means that the certificate I need is not necessarily a server certificate, because in this scenario Exchange
Server is acting as a client to the upstream SMTP Smart Host. I have openssl at my disposal, so making the certificate in not a problem but installing it in the correct location and testing that I've done what I think I've done is.
Thanks for the help,
Chris.
Thanks for the help,
Chris.

Hi,
Please just make sure the primary certificate in your Exchange server with
SMTP service is valid, trusted by your SMTP smart host.
Thanks,
Winnie Liang
TechNet Community Support

Changing SSL certificate for ICM

Hello,
I'd like to change SSL certificate for ICM service. I've change it in STRUST, but when I run web browser, server sends old one. IT is very odd, that ICM still works after deleteing all "SSL Server" certificates in STRUST. I tried to restart whole SAP system, but it did not help.
Is there any possibility to change working certificate? What should I do to make such change?

> I often use transaction SMICM -> Administration -> ICM -> Exit soft to restart only the ICM without interrupting the whole SAP system.
> You should increase the ICM trace level, restart it and look at the trace file to try to find out what's wrong.
OK, ICM runs properly now. I have no idea why, as I did not change anything. Maybe "soft restart" invoked few times helped.
> Of course. In my company we use our own internal CA for intranet use and Verisign for internet use.
> (for internet use the certificate in on the reverse proxy in the DMZ).
Here I've got another problem.
I've started with something simple. STRUST->SSL server->Create Certificate Request. My CA has signed this request. Now, when I'm trying to install signed certificate, I got an error "Cannot import certificate response".
As my CA is not signed by any well known CA e.g. VeriSign), I've added my CAs certificate to SAP database (as root CA and server CA), butit did not help.
In SSL server, I've got "(self signed)" below "own certif." field and I cannot change it
If it's not a big problem, could you write down, what should I do to install external SSL certificate signed by not well-known CA.
Many thanks for your help,
regards,
Konrad

SSL certificate for database

Hi all,
I want to know whether I need separate SSL certificate for each database on that server or can I take for the server and use it?
And also how to get SSL certificate for database form Godaddy?
Any help would be great.
Thanks
Rajitha
--------------------------------------------------------------------------------

Pl refer to Oracle® Database Advanced Security Administrator's Guide
10g Release 2 (10.2) from Oracle documentation.
You will find useful information on that related to this.
Dilipkumar Patel.

SSL Certificates for running J2ME applications.

We have developed a J2ME application for browing/uploading/downloading files from mobile device but we need SSL certificates to make our application work on mobile phones.
If anyone has knowledge of purchasing certificates for different handsets then please let us know as that would help us to launch our application on all handsets supporting JSR.

Hi JonRunheim,
Firstly, are the certificates purchased from an external Certificate Authority (CA) or internal?
On your Remote Desktop Session Hosts, can you bring up MMC, add the Certificates snap-in (for computer account, and then local computer)
Under Certificates\Personal\Certificates - check that the certificate you are using shows the small key symbol on top of the certificate icon (this indicates the private key). If you open the certificate, and select 'Certification Path' does it show three
levels of certificates, with all three certificates showing as 'This certificate is ok' under status?
If you repeat this process on one of your Windows 7 clients, (or from a server, and select 'Another computer' when adding the certificate snap-in) if you expand 'Trusted Root Certification Authorities\Certificates' and 'Intermediate Certification Authorities\Certficates'
are the certificates on the server matching those in your client?
If the CA is external, and they aren't present, you can manually update the list.
Download:
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Right click on the authroot.stl and select ‘Install CTL’
Select the default ‘Automatically select the certificate store based on the type of certificate’ and click next, then click finish. This should manually update your trusted certificate
authorities.
If your CA is internal, and they aren't present on the client, you need
to manually import your CA.
Hope this helps.
http://chrisocallaghan.blogspot.com/

Iplanet 6.0 creating a development SSL certificate for internal use

With IHS I can create my own SSL certificate when I want to do development work locally. I don't need to pay for a commercial one.
Is there a tool to create my own SSL certificate for development work with iplanet 6.0?

With IHS I can create my own SSL certificate when I want to do development work locally. I don't need to pay for a commercial one.
Is there a tool to create my own SSL certificate for development work with iplanet 6.0?

Why we need SSL Certificates for configuring App Server in Sharepoint

Similar Messages

Maybe you are looking for