1

Dear Support

I have two queries regarding ssl certificate

One

  1. We have created an ssl certificate with the name XYZ.LOCAL. Which we also implemented. So that has also been successful. Now my website is showing internally secure on the server.

  2. I also inserted this ssl in iis. But we are facing an issue. The client site is still showing as unsecured to me. So I installed that CA certificate in the client and the client is also showing as secure.

But how can we secure the internal without installing SSL on the client machine? Meaning I don’t have to install SSL in the client. If SSL is installed in the server, then it is not needed in the client, right?

second

We have purchased an SSL in the name of XYZ.IN. So what if I can put xyz.in certificate on xyz.local server, in iis server? Can we use this same certificate internally if mine is for external use?

Thanks in Advanced

Amol

3 Spice ups
2

If you are using active directory and your machines are domain joined, you would distribute the root and intermediate CA certificates to the client via GPO. The clients have to trust those in order to trust certificates issued by them.

If the same web server is accessible internally and externally, then just use the public certificate on your IIS server and go to xyz.in internally. Computers will trust a public certificate.

1 Spice up
3

Dear Sir,

Thank you very much for giving such a fast reply, I will try it once and update it tomorrow or next day.

ones again Thanks

1 Spice up
4

@PatrickFarrell

The SSL certificate that I have created which is internal server secure, will it be secure if I use it from another network i.e. from outside by entering DNS and run the website or will I have to use a public global certificate? This is just for understanding.

1 Spice up
5

easier to simply use an external wildcard…
Personally easier on a windows / nix box to use LetsEncrypt Certs using DNS-01
I use Cloudflare and Tokens for all most of my servers…

Older exchange servers are a bit trickier haven’t scripted those so I update a couple manually every ~60 days takes about 15-20min max via a saved pfx which works fine.

majority are auto update and apply so I live with the 1 or 2 manual out of 100ish.

internal vs external
Agree GPO is good - however using the public cert and just aiming DNS with a zone internally as needed works just fine.

win-acme + CF Plugin
*.xyz.in
DNS add zone xyz.in add a record / cname to server IP
ping to verify dns working
possibly add another a record for www & SOA public IP for website
apply cert server.xyz.in to iis
use incognito or other browser to verify cache good (F12 / debug fine in chrome based browsers and hard refresh cache also works – in dev mode right click reload its another option)

now internally the site loads fine - without any external access.
(old method would requite 80/443 inbound to apply the cert which is no good for iis)

Then for the ones that “Do” need external access NGINX Proxy manger as the reverse proxy and inbound with SSL cert same method CF and Token for the zone - and don’t need to do the windows IIS cert at all - just proxy https to http port 80 or whatever port is on.

Point is many options…

I setup 15-20 year certs on domains with XCA as the root cert and then published those via GPO for .local domains for ones that won’t ever be public… but only windows only and GPO systems - not recommended but works…

1 Spice up
6

No, external devices won’t trust your local AD Certificate authority and will continue to give you SSL warnings.

you need to use a public trusted certificate authority if you want to trust this beyond your AD Domain joined devices.

Take a look at https://letsencrypt.org/ this is what most people would use for getting a basic SSL cert these days. and bonus its free and you can automate the entire process to certs are issued applied and renewed automatically.

1 Spice up
7

@b-c

I really liked what you said and explained, thank you very much.

8

@molan

thank you very much too

9

For testing purposes only, you could actually use your internal cert on the external site, but you will get a security warning and you will have to allow it. Traffic will be encrypted.

For production, you must use a public issued cert on the external site.

11

In general this is accurate…
but 100% easier to do with something like XCA GitHub - chris2511/xca: X Certificate and Key management
What I’d love to see… is a nice opensource key server that can copy and paste LE Certs via scripts over to servers via SCP / SSH and automate things from each server from there…

Check 1 time a week
if new cert and key (or pfx) exist import and done.

gets tricky with other things.

Reason I don’t like AD CAs is the upgrades and management - MS never has made any of this consistently as easy… Like managing AD DHCP scopes and going from Older DHCP servers upgrading rarely works via export / import process - usually is a full rebuild… Not fun going back years on documentation re-reading and adapting…

similarly doing a public (LE DNS-01) cert for things like vmware vcenter and hosts…
there are ansible playbooks available but that is a whole new curve!

12

Just to add a bit of info you can use a tool like

to manage the LetsEncrypt.org certs. using a tool like this makes it very easy to use SSL certs as it will monitor and manage the renewal process as well as apply the changes to your IIS site for you. Well worth the small license fee.

There are other tools too, but this is my goto

1 Spice up
13

Thank you!