SSL certificates and SharePoint | Jack Fruh’s SharePoint blog

Configuring a sharepoint website to allow ssl connections at sharepoint config

Scenario #1a: you need a single cert, for a single domain name, on a single server.

This is the easiest so we’ll start with this one.

There are three types of SSL certificates:

In this Scenario, there are some things we’re going to “assume”:

• You have a single web server
• This server has a single IP address
• There is only one website on this server that needs SSL
• You are using IIS on Windows (Aka SharePoint)

Scenario #1b: you need a single cert, for a single domain name, on multiple web servers.

This scenario is identical to 1a, except that you have more than one web server.

First some good news: You don’t need to purchase a second SSL certificate.

The process for this scenario is the same as the first (1a) with a few extra steps at the end.

Scenario #3a: multinamed certificates

A MultiNamed certificate lets you assign more than one DNS name to a certificate. Each DNS name has to be specified, this is not a wildcard, anything goes cert. Security teams at large companies favor these over wildcards because they still have some control.

There is one small perk of using a MultiNamed certificate, you can share a single IP amongst all the Dns names the certificate supports.

Scenario #3b: multinamed certificates on multiple web servers.

Basically this is the same as Scenario 3a, but repeating parts on multiple web front ends, similar to what was mentioned for Scenarios 1b and 2b.  Here are some highlights.

Scenario #4a: wildcard cert with 1 or more websites, on a single server.

I have to confess, I’ve never laid my hands on a wildcard certificate, only heard rumors of their awesomeness when it comes to sharing an IP address with multiple DNS names. That said there are a few ground rules:

Scenario #4b: wildcard cert with 1 or more websites, on a multiple servers.

Same process as 4a, but you’ll copy the wildcard cert to multiple servers -(You’ll only need and pay for, one wildcard cert)

Scenario #5: self signed certificates.

These can be handy in a pinch for testing, not of much use for public facing websites.

Sharepoint 2021: installing your ssl certificate

Microsoft SharePoint 2021 does not include a GUI for installing the SSL Certificate. Because SharePoint 2021 is designed to run on Microsoft IIS 8, you can use IIS. If you have not yet created a Certificate Signing Request (CSR) and ordered your certificate, see Microsoft SharePoint 2021: SSL Certificate CSR Creation Instructions.

The SharePoint SSL Certificate installation process consists of three steps:

Installing the SSL Certificate

If you used IIS 8 to generate your CSR, you need to use IIS 8 to install the SSL Certificate,

If you used the DigiCert® Certificate Utility for Windows to generate your CSR, you need to use the DigiCert Certificate Utility to import/install your SSL Certificate.

Assigning or binding the certificate to your SharePoint site

Installing the root certificate

Step-1: generate csr

Open IIS Manager, then go to Server name, and choose IIS Section “Server Certificates”

Click on Create Certificate Request. on Actions pane

Enter the following Distinguished Name Properties, and then click next:

Note : The following characters are not accepted when entering information:

Common Name — The fully-qualified domain name (FQDN) — or URL — for which you plan to use your certificate (the area of your site you want customers to connect to using SSL).

Organization — The name in which your business is legally registered. The organization must be the legal registrant of the domain name in the certificate request.

Note: If you are enrolling as an individual, enter the certificate requester’s name in the Organization field, and the Doing Business As (DBA) name in the Organizational Unit field.

Organizational Unit — Use this field to differentiate between divisions within an organization (such as «Engineering» or «Human Resources»).

City/Locality — The full name of the city in which your organization is registered/located. Do not abbreviate.

State/Province — The full name of state or province where your organization is located. Do not abbreviate.

Country — The two-letter International Organization for Standardization- (ISO-) format country code for the country in which your organization is legally registered.

For Cryptographic service provider, select Microsoft RSA SChannel Cryptographic Provider.

For Bit length, select 2048 or higher, and then click Next.

Click …, enter the location and file name for your CSR, and then click Finish.

Step-2 : download ssl from ssl provider

Now that we have generated the CSR, we must enter it in SSL Provider account with us to request the SSL certificate. Then, complete the process by downloading and installing the certificate.

1. Locate, copy, and paste the CSR into our online application to request the SSL certificate.

Note: To get a copy, right-click the .req file, select Open With, and then select a text editor like Notepad.

Paste all of the text, including —-BEGIN NEW CERTIFICATE REQUEST—- and —-END CERTIFICATE REQUEST—-, in our online application.

1. Once we approve your application, download the primary and intermediate certificate.

Step-3 : install and configure ssl in iis on windows server

1. Install the certificate by completing the pending request, importing the certificate file, and selecting the services to which the certificate applies.
2. On the server where you created the CSR, save the SSL certificate .cer file (e.g., your_domain_com.cer) that you received from SSL Provider.
3. From the Start screen, find Internet Information Services (IIS) Manager and open it.
4. In the Connections pane, locate and click the server.
5. In the server Home page (center pane) under the IIS section, double-click Server Certificates.
6. In the Actions menu (right pane), click Complete Certificate Request.
7. In the Complete Certificate Request wizard, on the Specify Certificate Authority Response page, provide the following information.
8. Import SSL certificate, Intermediate certificate to Certificate store.
   1. Go to RUN and type MMC
   2. In MMC Console go to File and Add or Remove Snap-ins
   3. Select Certificate in Add or Remove Snap-ins and click Next
   4. Select Computer account then Next
   5. Click Finish
   6. Click OK
   7. Expand the certificate roon in MMC console
   8. Right click on Personal->All Tasks->Import (import the *.p7b file)
9. Now that we have successfully installed SSL certificate, we need to configure site to use it.

Step-6: perform an iisreset to all the wfe server

Update IIS Site Bindings in all WFE Servers

When IIS returns, launch the CA. Remember, after an IISReset SharePoint sites, including the CA, take a minute to launch on the first time in

источник

Using iis 8 to assign the certificate to the sharepoint website

In Internet Information Services (IIS) Manager, under Connections, expand your server’s name, expand Sites, and then select the SharePoint site.

In the Actions menu, under Edit Site, click Bindings.

In the Site Binding window, click Add.

In the Add Site Bindings window, enter the following information:

When you are finished, click OK.

Now you need to install the root certificate on your SharePoint server.

Using iis 8 to install the ssl certificate

After DigiCert validates and issues your SSL Certificate, you can use Microsoft IIS 8 to install your SSL Certificate to the server where you generated the CSR, and then, bind it the SharePoint site.

Save the SSL Certificate file (your_domain_name.cer) to the server on which the CSR was generated.

Open Internet Information Services (IIS) Manager.

From the Start screen, type and click Internet Information Services (IIS) Manager.

In Internet Information Services (IIS) Manager, under Connections, select your server’s Hostname.

In the center menu, in the IIS section, double-click the Server Certificates icon.

In the Actions menu, click Complete Certificate Request to open the Complete Request Certificate wizard.

On the Specify Certificate Authority Response page, under File name containing the certification authority’s response, click … to browse to the .cer certificate file that DigiCert sent you, select the file, and then, click Open.

Next, in the Friendly name box, enter a friendly name for the certificate. The friendly name is not part of the certificate; instead, it is used to identify the certificate.

We recommend that you add DigiCert and the expiration date to the end of your friendly name, for example: yoursite-DigiCert-expirationDate. This information helps identify the issuer and expiration date for each certificate. It also helps distinguish multiple certificates with the same domain name.

Next, in the Select a certificate store for the new certificate drop-down list, select Personal.

To install the SSL Certificate to the server, click OK.

Once you have successfully installed the SSL Certificate to the server, you still need use IIS to assign or bind that certificate to the SharePoint site.

Using sharepoint 2021 to install the root certificate

In the DigiCert® Management Console, under Order, click the order number for the SSL Certificate that you just installed.

On the My Orders tab, click Download.

In the Download Certificate section, click the Download or Copy/Paste Individual Certificates link.

Next, click the ROOT CERTIFICATE icon.

In the Opening TrustedRoot.crt window, click Save File to save the file to your SharePoint server.