This week I spent a considerable amount of time installing and troubleshooting a SSL install on IIS 6. I won't get into downloading and applying the Cert- that is documented everywhere. Here are few things to check for that will make it easier to get it all working.

1. You HAVE to specify an IP Address in the Web Site Identification box. The default is (All unassigned). Make sure to click on the "Advanced" button and add that IP address in the SSL Identities for the website. If you don't specify an IP Address for the SSL identity it will not work.

2. Make sure your Certficate Chain is valid. The easiest way to do this is with the SSL Diagnostics utility. Run the diagnostics and make sure there are NO errors at all. If there are then your certificate will not work. For the chaining, look at the CertVerifyCertificateChainPolicy and make sure it says "succeeded".

3. Once you have the chain and the IP addresses set it is simple to secure different folders or files on your web server. You either go into "Directory Security" or "File Security". In the "Secure communications" section go to "Edit" and check the box "Require secure channel (SSL)".

Labels: Certificate, CertVerifyCertificateChainPolicy, IIS 6, SSL, SSL Diagnostics, Troubleshooting

posted by solutionsguy at 10:32 AM