SSL / port 443

HCL Domino Domino Forum
1

I have a Domino 8.5.2 server running on Windows 2008 R2. It also has Traveler 8.5.2 installed. I am trying to enable SSL and I am having issues.

Right now I have BOTH port 80 and port 443 enabled (no fail over, I’ll set that when I have 443 working). A Domino “show tasks” shows that http is listening on both port 80 and 443. A “netstat -nab” from a Windows command prompt shows that both 80 and 443 are listening.

Accessing http://myserver.mydomain.com results in a login window and then the correct servlet/traveler page. However, accessing https://myserver.mydomain.com results in “Internet Explorer cannot display the webpage,” even if the URL is accessed from the server console (taking any Windows firewall issues out of the equation).

I can connect via telnet to port 443, just not through a browser. I’ve tried shutting down antivirus on the server and it didn’t make a difference. Can anyone give me any ideas on what to try next???

2

Subject: Firewall

I wouldn’t rule out firewall on W2008 R2 even if you tried locally. Try disabling the firewall on the server.

3

Subject: This worked for me.

Hello,

I experienced the exact same problem.

I discovered that I created a Key Ring file (option 1. on the Server Certificate Administration page) instead of creating a Key Ring file with Self-Certified Certificate (bottom option).

I hope this helps.

Dan

4

Subject: Questions

Did you create your own SSL certificate or did you purchase one from a third party? Is it properly installed in the key ring?

What do you see when you do a “tell http sh security”? Does it show SSL Enabled and the correct keyfile name?

5

Subject: SSL / port 443

Thanks for your help.

We have an active directory certificate authority set up in-house - the same trusted root I have for every other Domino server. I have 4 other Domino servers that use this certificate for SSL with no issues (although this is the first 8.5.2 server and the first time we’ve used Traveler).

Tell http show security comes up with “SSL enabled” and the correct key file name (not the standard, but I have changed it at ports > internet ports in the server document and I’ve verified that it does match).

If the issue was a certifier issue, wouldn’t the page still come up, just with a certifier/trust error?

6

Subject: Interesting

I agree that it’s not a certificate issue.

I’m not sure what’s going on but I wonder if you can you open a database if you append the file name to your URL, e.g. https://myserver.mydomain.com/testdb.nsf

7

Subject: same error

No, any filename appended to the URL results in the same error as hitting the home page of the server. I’ve tried https://myserver.mydomain.com/names.nsf , https://myserver.mydomain.com/names.nsf?opendatabase&login , as well as hitting mail files on the server.

8

Subject: Quite odd

I’m running out of ideas. I assume you’ve tried different browsers to rule out IE as the culprit. MS has a tech note on the error message, http://support.microsoft.com/kb/956196 but if you’re getting the same thing in Firefox or Chrome then obviously IE isn’t the issue. Sorry I couldn’t offer any useful insight.

9

Subject: other browsers

The errors in Firefox and Chrome are slightly different. Firefox says the connection was interrupted, and Chrome says it is SSL connection error 107.

The SSL connection error doesn’t make sense to me … if it was really SSL that was messed up, IE should still give me an opportunity to continue to the web page anyway, right?

I saw that the Chrome SSL connection error sometimes means that SSL 2.0 wasn’t enabled - I tried enabling it in IE and I still couldn’t hit the site.

The “page cannot be displayed” error is affecting everyone who tries to hit the site, regardless of OS or browser version.

10

Subject: Did you ever succeed in resolving this?

We are experiencing the EXACT same issue here (same configuration/version/everything).

I even tried creating Internet Site documents and modifying the Server document, but that didn’t resolve it either. Do we need to re-boot the entire server after making that change, or will a simple re-start of the HTTP server suffice (I only re-started HTTP)?

If you’ve made any progress, please let us know (and we’ll do the same!).

Cheers!

T.

11

Subject: This solved my problem

I was using internet certificates and had the exact same problem. Adding the server ip address in the host name field solved it: http://www-01.ibm.com/support/docview.wss?uid=swg21104852