Simon's questions

I have done the following:

• Installed the Centralized Certificate Store feature
• Created a network share and set the passwords
• Created example.com.pfx and www.example.com.pfx files in the share
• Verifed that my certificates are listed in IIS under Centralized Certificates
• Selected Require Server Naem Indication and Use Centralized Certificate store for my domain and created a site binding for the correct IP address and hostname example.com
• Stopped all websites except the one I'm working on.

My browser does not pick up the certificate!

It picks up the machine certificate.

I did the following :

• Made an Azure load balancer to an availability group of 2 VMs
• Created an HTTP health probe to monitor the site going to /
• Verified that the site would respond to http://10.0.0.7:80/

The site doesn't come up.

The firewall is fine. If I switch to a TCP probe on port 80then the site comes up.

I just installed the latest Windows update (NSA vulnerability patch tuesday) and now I cannot connect to remote desktop.

• The server is remotely hosted. I don't have physical access. Server 2012 R1.
• Fortunately all web sites are running ok after reboot.
• I have not yet tried a second reboot because I'm a little scared to.
• When I try to connect I immediately get this message:
• "Remote Desktop Connection : An internal error has occured"

• Have tried from multiple clients. They all fail - including an iOS app which in addition gives me a 0x00000904 error.
• If I run telnet servername 3389 then it does initiate a connection, so I know the port is open.
• I can connect just fine to other servers from my Win 10 (unpatched) machine.
• I cannot connect from my second laptop either, which is Win 10 Creators edition.
• Cannot find anything useful in Event Viewer.
• I've even tried wireshark which didn't show me anything useful.
• The best I have to diagnose is the ability to upload an ASPX page and run it.

I understand that the recent 'NSA edition' patch roundup had some RDP fixes - but I can't find anyone else who suddenly had issues hit week.

I want to have an idea what the problem is before I contact the hosting company, which is why I'm posting here.

Update:

While I still don't have physical server access I remembered I have a Windows 7 VM hosted on the server itself. I was able to get into this and open the server certificates snap-in by connecting to the 10.0.0.1 local IP.

This is showing that the RDP certificate is indeed expired - although I get no errors when connecting that suggest as such. I certainly have been connecting daily and since it expired 2 months ago my guess is that some kind of security update removed whatever other certificate was in the Remote Desktop store and it did not renew itself.

So trying to figure out a way to install a different cert here now.

Update 2

Finally found this in the event log under 'Administrative Events' (by connecting remotely via the VM) :

"The Terminal Server has failed to create a new self signed certificate to be used for Terminal Server authentication on SSL connections. The relevant status code was Object already exists."

This seems helpful, albeit a slightly different error. Can't reboot tonight though so will have to check again tomorrow.

https://blogs.technet.microsoft.com/the_9z_by_chris_davis/2014/02/20/event-id-1057-the-terminal-server-has-failed-to-create-a-new-self-signed-certificate/

I have two different 'families' of related sites, each with their own UCC certificate on the same server.

I'm hosting them on the same IIS server, using one IP address for each family.

Both UCC certficates are from GoDaddy.

Every one of the bindings (for each SAN in the UCC) has 'Require Server Name indication' disabled.

However when I try to hit the site from IE 8 on Windows XP only one of the 'families' of sites works. The other just doesn't negotiate.

When analyzing the SSL on SSLLabs.com I get the following result - telling me 'This site works only in browsers with SNI support.'

But how is this possible! I have disabled 'Require SNI' for every :443 binding.

I've even looked at the applicationHost.config file and there isn't a single site with sslFlags="1" to indicates this setting is enabled. Yes I also restarted IIS.

What's going on. I'm very stumped. I'm wondering if I can completely disable SNI on the server somehow, or what would have triggered this to happen. I did several months of Windows updates yesterday, but to be frank I think it has been this way for a long time without me realizing - based on $0 in sales from IE8 XP clients ;-)

Edit: I'm really thinking my IIS has become corrupted. When I run netsh http show sslcert every single binding is of the form IP:port. According to this article if SNI is enabled then I would see hostname:port and I see no entries in this format. There's also no entries in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\SslSniBindingInfo in the registry - but I confirmed that a new one is created here if I temporarily add an SNI binding.

IP:port                      : 10.0.0.2:443
Certificate Hash             : d59a149e6678bc10d62093401c5b705cc23094be
Application ID               : {4dc3e181-e14b-4a21-b022-59fc669b0914}
Certificate Store Name       : My
Verify Client Certificate Revocation : Enabled
Verify Revocation Using Cached Client Certificate Only : Disabled
Usage Check                  : Enabled
Revocation Freshness Time    : 0
URL Retrieval Timeout        : 0
Ctl Identifier               : (null)
Ctl Store Name               : (null)
DS Mapper Usage              : Disabled
Negotiate Client Certificate : Disabled

I have a single IIS website which hosts 3 different websites all using the same UCC SSL certificate. (The code of my site examines the host header itself to decide which variation of the site to show).

I fixed my most fatal mistake already for my Internet Explorer users on XP which is to disable the 'Require Subject Name Indication' field in IIS. Since SNI is not supported on Windows XP if it were enabled when an XP user switched to HTTPS they would basically get kicked off the site with no warning (don't tell my boss).

So I completely understand that when a user accesses any one of the 3 sites via HTTPS that all share the same IP, he is sent to the same IIS site and served the UCC certificate. Even XP supports UCC/SAN certificates so the client accepts the certificate and shows the site as expected.

Now.... forget all that and consider a second non hypothetical scenario.

• Lets pretend I have two sites : cats.com and dogs.com
• They're different sites and are deployed in two different websites in IIS 8.
• They're both on the same UCC SSL certificate*
• SNI is disabled
• They are both bound to the same IP address

Now consider XP users accessing https://cats.com

Here's how I understand things work:

• DNS gives the browser back my IP - lets say 1.2.3.4
• An HTTPs connection is negotiated,but because XP doesn't know anything about SNI it isn't sending an SSL host header (or whatever they're called) but just accessing the secure site via the IP.
• So IIS will look for that IP associated with an https website binding, and it will actually find TWO.
• Let's say IIS decides to just serve you the first one - so it gives you cats.com which is what you're expecting. So that's fine.
• BUT lets say you go to https://dogs.com - shouldn't you be actually served the site for cats.com because SSL on XP doesn't know about SNI for SSL connections and anyway it's disabled in IIS?

Well you don't. You get dogs.com. I've tried this, and cats.com and dogs.com both work from a Windows XP Internet Explorer 8 client.

I just don't understand why this works. I would have expected this behavior only in my first scenario when they all share a single IIS application.

My best guess is that IIS 8 is receiving the host header anyway and being smart enough to route it to the correct website and finds a UCC certificate name. Is that what's happening?

Can someone explain further?

* just to deliberately annoy techically minded cat and dog owners ;-)

After having had EV SSL certificate installed a couple months we got an email from GoDaddy telling us the certificate chain was incorrect. They requested we disable 'GoDaddy Class 2 root certificate' and be sure that we had the correct certificates installed. (presumably i messed something up when i first configured it)

However I had not seen any certificate errors myself in the last couple months - but at least since making the changes they requested it seems that the certificate is testing OK now. (unfortunately i didnt not find this site until after I made the changes so I don't know what it would have tested before)

What I'm wondering therefore is what is the worst that could have happened in the meantime. Did some people not get a green bar? Did people get a warning? Or does it not really matter?

I'm also slightly concerned that other non EV certificates are affected by disabling all purposed for the Class 2 certificate - is that possible?

I need to set up a UNC share for my hosted dedicated server to access a share on itself. Unfortunately TFS requires a UNC share.

I am on a Windows Server 2008 Standard SP2 64bit dedicated server behind a PIX 501 firewall hosted with GoDaddy.

I just cannot get the server to access itself and get this error:

Windows cannot access \\SERVER\SHARE Check the spelling of the name.. etc.

I've found numerous questions about this but no answer to my problem.

• Server 2008 Standard x64 SP2
• Workgroup - not domain
• Windows Firewall is off
• Computer browser service is on
• I am trying to access \\MYMACHINE\TFS-BUILDS by typing in - or double clicking. Neither works.
• Machine has single network card
• Filesharing wizard says share was ok
• Share was showing under 'Computer management'
• Permissions are set to 'everyone' full control
• No obvious errors in eventlog
• Reboot didn't fix it
• Unfortunately I cannot try to access other shares in or out of this machine because it is a hosted dedicated server and the only machine behind a hardware firewall.

The only thing left i can think of is that the hardware firewall needs to be configured. I don't think it is this because we have a 2003 Server machine behind a different hardware firewall and that one works fine.

What on earth is left?!

I have at least one database file that is too big to backup on my server.

I want to make sure when I uninstall a botched upgrade to SQL Server 2008 that it won't delete any of my .mdf files that I've created myself under SQL Server 2005.

I'm pretty sure this is correct?

Possible Duplicate:
Can you help me with my software licensing question?

Do any hosting companies offer SQL Server 2008 Web edition in a hosting plan.

GoDaddy for instance offers Standard/Enterprise editions which raise the price by $200 or so a month.

I've tried a few hosting companies and can't find the web edition available. Why not?

The web edition is supposed to be only $15/month - but I was hoping to be able to get this pricing through a dedicated server and not have to go off and separately get the licensing. I don't even know if its possible to buy just one copy!?

We have gmail for our corporate email provider.

I want to be able to send mail through smtp.gmail.com from ASP.NET. I have managed to do this just fine - and it has the benefit of all sent items appearing in the correct sent items folder within gmail. However it can take up to 2-3 seconds to make a connection to smtp.gmail.com. Occasionally it will even fail completely. Since this is ASP.NET app I need to be able to reliably send email. I don't want to have to go and create some email daemon of my own - i just want to rely on SMTP.

I've tried with the Virtual SMTP Server on IIS6 but haven't been able to get it to work. An active current session is shown for up to a minute and then it disappears.

Do I need to use something like sendmail to do this - or some other free SMTP relay that gives me better control? I even found a sourceforge project called 'Gmail SMTP Relay' - and the hosted server we're using has installed - which has its own SMTP server.

I'd prefer something graphical - and most of all I'd prefer the Microsoft SMTP server becasue I already have it installed.

The answer I can find in the FAQ is as follows

An object stays in an edge location until it expires. After the object expires, CloudFront must go back to the origin server the next time that edge location needs to serve that object. By default, all objects automatically expire after 24 hours.

However, I've been noticing recently that objects seem to be getting updated much more frequently than this. I tested a text file and changed it, and within the hour it reflected the change.

I'm just not clear if this was a fluke - or if they changed the expiration rules. Is this country/region specific - or were they just doing routine maintenance at the exact hour I tested (unlikely!) ?