Problem with SSL with a sub domain

[Dany C.]

We have install a valid SSL certificate issued to www.mycompany.com on our
web server running IIS 6.0 / win2003 SP1. Then we have created a sub domain
pointing to the same server for our web services at ws.mycompany.com. We have
properly installed the server certificate on the client machine.

When the client try to connect to our secure webservice at
https:\\ws.mycompany.com we have the foolwing error:

System.Net.WebException: The underlying connection was closed: Could not
establish trust relationship with remote server.

--
Dany Couillard, ing.

[Steven Cheng[MSFT]]

Hi Dany,

Welcome to MSDN newsgroup.
From your description, the problem occurs when you accessing the remote
webservice through the subdomain url and the webserver's server
certificated is obtained through the top domain name. I think we can try
the following test to confirm whether the problem is caused by the
inconsistent of the certificate issue name and the webserver's site
name(sub domain name):

1. create an asp.net webpage(not asmx webservice) under the web site which
used SSL protection and is available through sub domain url.

2. At clientside use IE to request that page through https url (sub domain
name) to see whether the page can be viewed directly or will occur a dialog
indicate that there has some thing wrong with the serverside certificate. I

f the dialog popup, that means the clientside found the certificate
inconsistent with the site's name. Since when calling the webservice
programmatically, there hasn't means for us to suppress such warning like
we interactivly in IE, so there may lead to a connection failed exception.

Please have a check and let me know if this is the problem so that we can
continue to do some further invesigation.

Thanks,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)
--------------------
Thread-Topic: Problem with SSL with a sub domain
thread-index: AcWzQRoyyWc7+S+lQJitPF0V8tFS9g==
X-WBNR-Posting-Host: 69.159.133.147
From: "=?Utf-8?B?RGFueSBDLg==?=" <dc********@newsgroups.nospam>
Subject: Problem with SSL with a sub domain
Date: Tue, 6 Sep 2005 17:14:24 -0700
Lines: 13
Message-ID: <40**********************************@microsoft.co m>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Utf-8"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
Newsgroups: microsoft.public.dotnet.framework.webservices
NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFT NGXA03.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl
microsoft.public.dotnet.framework.webservices:7798
X-Tomcat-NG: microsoft.public.dotnet.framework.webservices

We have install a valid SSL certificate issued to www.mycompany.com on our
web server running IIS 6.0 / win2003 SP1. Then we have created a sub
domain
pointing to the same server for our web services at ws.mycompany.com. We
have
properly installed the server certificate on the client machine.

When the client try to connect to our secure webservice at
https:\\ws.mycompany.com we have the foolwing error:

System.Net.WebException: The underlying connection was closed: Could not
establish trust relationship with remote server.

--
Dany Couillard, ing.

[Dany C.]

Thank Steven for your welcome note.

You were right in your assumptions. We have created an aspx as mentionned.
When we access the https:\\ws.mycompany.com\helloword.aspx we have this
security alert popup:

-The name on the certificate is invalid or does not match the name of the
site!
-Certificate is from a trusted authority
-Certificatace is valid

We have the option to proceed or not.

--
Dany Couillard, ing.
"Steven Cheng[MSFT]" wrote:

Hi Dany,

Welcome to MSDN newsgroup.
From your description, the problem occurs when you accessing the remote
webservice through the subdomain url and the webserver's server
certificated is obtained through the top domain name. I think we can try
the following test to confirm whether the problem is caused by the
inconsistent of the certificate issue name and the webserver's site
name(sub domain name):

1. create an asp.net webpage(not asmx webservice) under the web site which
used SSL protection and is available through sub domain url.

2. At clientside use IE to request that page through https url (sub domain
name) to see whether the page can be viewed directly or will occur a dialog
indicate that there has some thing wrong with the serverside certificate. I

f the dialog popup, that means the clientside found the certificate
inconsistent with the site's name. Since when calling the webservice
programmatically, there hasn't means for us to suppress such warning like
we interactivly in IE, so there may lead to a connection failed exception.

Please have a check and let me know if this is the problem so that we can
continue to do some further invesigation.

Thanks,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)
--------------------
Thread-Topic: Problem with SSL with a sub domain
thread-index: AcWzQRoyyWc7+S+lQJitPF0V8tFS9g==
X-WBNR-Posting-Host: 69.159.133.147
From: "=?Utf-8?B?RGFueSBDLg==?=" <dc********@newsgroups.nospam>
Subject: Problem with SSL with a sub domain
Date: Tue, 6 Sep 2005 17:14:24 -0700
Lines: 13
Message-ID: <40**********************************@microsoft.co m>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Utf-8"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
Newsgroups: microsoft.public.dotnet.framework.webservices
NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFT NGXA03.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl
microsoft.public.dotnet.framework.webservices:7798
X-Tomcat-NG: microsoft.public.dotnet.framework.webservices

We have install a valid SSL certificate issued to www.mycompany.com on our
web server running IIS 6.0 / win2003 SP1. Then we have created a sub
domain
pointing to the same server for our web services at ws.mycompany.com. We
have
properly installed the server certificate on the client machine.

When the client try to connect to our secure webservice at
https:\\ws.mycompany.com we have the foolwing error:

System.Net.WebException: The underlying connection was closed: Could not
establish trust relationship with remote server.

--
Dany Couillard, ing

[Steven Cheng[MSFT]]

Thanks for your response Dany,

So for this problem, in .net we can try providing a custom
CertificatePolicy for our client application. You can have a look at the
System.Net.ICertificate Interface.

#ICertificatePolicy Interface
http://msdn.microsoft.com/library/en...neticertificat
epolicyclasstopic.asp?frame=true

We just need to define a custom class implemetning it and write our own

public bool CheckValidationResult(ServicePoint sp, X509Certificate cert,
WebRequest request, int problem)
{

....
}

method, e.g, we can always return true in it so that the validation on
server certificate always succeed.
Hope helps.
Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)
--------------------
Thread-Topic: Problem with SSL with a sub domain
thread-index: AcWzw/kzM8/oLqoMSdWXIY9SAhrHQA==
X-WBNR-Posting-Host: 69.159.134.162
From: "=?Utf-8?B?RGFueSBDLg==?=" <dc********@newsgroups.nospam>
References: <40**********************************@microsoft.co m>
<LU**************@TK2MSFTNGXA01.phx.gbl>
Subject: RE: Problem with SSL with a sub domain
Date: Wed, 7 Sep 2005 08:51:13 -0700
Lines: 94
Message-ID: <C7**********************************@microsoft.co m>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Utf-8"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
Newsgroups: microsoft.public.dotnet.framework.webservices
NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl
microsoft.public.dotnet.framework.webservices:7814
X-Tomcat-NG: microsoft.public.dotnet.framework.webservices

Thank Steven for your welcome note.

You were right in your assumptions. We have created an aspx as mentionned.
When we access the https:\\ws.mycompany.com\helloword.aspx we have this
security alert popup:

-The name on the certificate is invalid or does not match the name of the
site!
-Certificate is from a trusted authority
-Certificatace is valid

We have the option to proceed or not.

--
Dany Couillard, ing.
"Steven Cheng[MSFT]" wrote:

Hi Dany,

Welcome to MSDN newsgroup.
From your description, the problem occurs when you accessing the remote
webservice through the subdomain url and the webserver's server
certificated is obtained through the top domain name. I think we can try
the following test to confirm whether the problem is caused by the
inconsistent of the certificate issue name and the webserver's site
name(sub domain name):

1. create an asp.net webpage(not asmx webservice) under the web site which used SSL protection and is available through sub domain url.

2. At clientside use IE to request that page through https url (sub domain name) to see whether the page can be viewed directly or will occur a dialog indicate that there has some thing wrong with the serverside certificate. I
f the dialog popup, that means the clientside found the certificate
inconsistent with the site's name. Since when calling the webservice
programmatically, there hasn't means for us to suppress such warning like
we interactivly in IE, so there may lead to a connection failed exception.
Please have a check and let me know if this is the problem so that we can
continue to do some further invesigation.

Thanks,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)
--------------------
Thread-Topic: Problem with SSL with a sub domain
thread-index: AcWzQRoyyWc7+S+lQJitPF0V8tFS9g==
X-WBNR-Posting-Host: 69.159.133.147
From: "=?Utf-8?B?RGFueSBDLg==?=" <dc********@newsgroups.nospam>
Subject: Problem with SSL with a sub domain
Date: Tue, 6 Sep 2005 17:14:24 -0700
Lines: 13
Message-ID: <40**********************************@microsoft.co m>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Utf-8"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
Newsgroups: microsoft.public.dotnet.framework.webservices
NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFT NGXA03.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl
microsoft.public.dotnet.framework.webservices:7798
X-Tomcat-NG: microsoft.public.dotnet.framework.webservices

We have install a valid SSL certificate issued to www.mycompany.com on our web server running IIS 6.0 / win2003 SP1. Then we have created a sub
domain
pointing to the same server for our web services at ws.mycompany.com. We
have
properly installed the server certificate on the client machine.

When the client try to connect to our secure webservice at
https:\\ws.mycompany.com we have the foolwing error:

System.Net.WebException: The underlying connection was closed: Could not
establish trust relationship with remote server.

--
Dany Couillard, ing

[Dany C.]

Thanks Steven,

This issues is now resolved.

Dany Couillard, ing.
"Steven Cheng[MSFT]" wrote:

Thanks for your response Dany,

So for this problem, in .net we can try providing a custom
CertificatePolicy for our client application. You can have a look at the
System.Net.ICertificate Interface.

#ICertificatePolicy Interface
http://msdn.microsoft.com/library/en...neticertificat
epolicyclasstopic.asp?frame=true

We just need to define a custom class implemetning it and write our own

public bool CheckValidationResult(ServicePoint sp, X509Certificate cert,
WebRequest request, int problem)
{

....
}

method, e.g, we can always return true in it so that the validation on
server certificate always succeed.
Hope helps.
Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)
--------------------
Thread-Topic: Problem with SSL with a sub domain
thread-index: AcWzw/kzM8/oLqoMSdWXIY9SAhrHQA==
X-WBNR-Posting-Host: 69.159.134.162
From: "=?Utf-8?B?RGFueSBDLg==?=" <dc********@newsgroups.nospam>
References: <40**********************************@microsoft.co m>
<LU**************@TK2MSFTNGXA01.phx.gbl>
Subject: RE: Problem with SSL with a sub domain
Date: Wed, 7 Sep 2005 08:51:13 -0700
Lines: 94
Message-ID: <C7**********************************@microsoft.co m>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Utf-8"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
Newsgroups: microsoft.public.dotnet.framework.webservices
NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl
microsoft.public.dotnet.framework.webservices:7814
X-Tomcat-NG: microsoft.public.dotnet.framework.webservices

Thank Steven for your welcome note.

You were right in your assumptions. We have created an aspx as mentionned.
When we access the https:\\ws.mycompany.com\helloword.aspx we have this
security alert popup:

-The name on the certificate is invalid or does not match the name of the
site!
-Certificate is from a trusted authority
-Certificatace is valid

We have the option to proceed or not.

--
Dany Couillard, ing.
"Steven Cheng[MSFT]" wrote:

Hi Dany,

Welcome to MSDN newsgroup.
From your description, the problem occurs when you accessing the remote
webservice through the subdomain url and the webserver's server
certificated is obtained through the top domain name. I think we can try
the following test to confirm whether the problem is caused by the
inconsistent of the certificate issue name and the webserver's site
name(sub domain name):

1. create an asp.net webpage(not asmx webservice) under the web site

which

used SSL protection and is available through sub domain url.

2. At clientside use IE to request that page through https url (sub

domain

name) to see whether the page can be viewed directly or will occur a

dialog

indicate that there has some thing wrong with the serverside certificate.

I

f the dialog popup, that means the clientside found the certificate
inconsistent with the site's name. Since when calling the webservice
programmatically, there hasn't means for us to suppress such warning like
we interactivly in IE, so there may lead to a connection failed

exception.

Please have a check and let me know if this is the problem so that we can
continue to do some further invesigation.

Thanks,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)
--------------------
Thread-Topic: Problem with SSL with a sub domain
thread-index: AcWzQRoyyWc7+S+lQJitPF0V8tFS9g==
X-WBNR-Posting-Host: 69.159.133.147
From: "=?Utf-8?B?RGFueSBDLg==?=" <dc********@newsgroups.nospam>
Subject: Problem with SSL with a sub domain
Date: Tue, 6 Sep 2005 17:14:24 -0700
Lines: 13
Message-ID: <40**********************************@microsoft.co m>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Utf-8"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
Newsgroups: microsoft.public.dotnet.framework.webservices
NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFT NGXA03.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl
microsoft.public.dotnet.framework.webservices:7798
X-Tomcat-NG: microsoft.public.dotnet.framework.webservices

We have install a valid SSL certificate issued to www.mycompany.com on

our

web server running IIS 6.0 / win2003 SP1. Then we have created a sub
domain
pointing to the same server for our web services at ws.mycompany.com. We
have
properly installed the server certificate on the client machine.

When the client try to connect to our secure webservice at
https:\\ws.mycompany.com we have the foolwing error:

System.Net.WebException: The underlying connection was closed: Could not
establish trust relationship with remote server.

--
Dany Couillard, ing

[Steven Cheng[MSFT]]

You're welcome Dany,

Have a nice weekend!

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

--------------------
Thread-Topic: Problem with SSL with a sub domain
thread-index: AcW0jSabW6bFI6yETDKvMy6NN2aR9Q==
X-WBNR-Posting-Host: 69.159.134.54
From: "=?Utf-8?B?RGFueSBDLg==?=" <dc********@newsgroups.nospam>
References: <40**********************************@microsoft.co m>
<LU**************@TK2MSFTNGXA01.phx.gbl>
<C7**********************************@microsoft.co m>
<Sn**************@TK2MSFTNGXA02.phx.gbl>
Subject: RE: Problem with SSL with a sub domain
Date: Thu, 8 Sep 2005 08:51:18 -0700
Lines: 169
Message-ID: <08**********************************@microsoft.co m>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Utf-8"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
Newsgroups: microsoft.public.dotnet.framework.webservices
NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGXA01.phx.gbl!TK2MSF TNGXA03.phx.gbl
Xref: TK2MSFTNGXA02.phx.gbl
microsoft.public.dotnet.framework.webservices:1198 9
X-Tomcat-NG: microsoft.public.dotnet.framework.webservices

Thanks Steven,

This issues is now resolved.

Dany Couillard, ing.
"Steven Cheng[MSFT]" wrote:

Thanks for your response Dany,

So for this problem, in .net we can try providing a custom
CertificatePolicy for our client application. You can have a look at the
System.Net.ICertificate Interface.

#ICertificatePolicy Interface
http://msdn.microsoft.com/library/en...neticertificat epolicyclasstopic.asp?frame=true

We just need to define a custom class implemetning it and write our own

public bool CheckValidationResult(ServicePoint sp, X509Certificate cert,
WebRequest request, int problem)
{

....
}

method, e.g, we can always return true in it so that the validation on
server certificate always succeed.
Hope helps.
Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)
--------------------
Thread-Topic: Problem with SSL with a sub domain
thread-index: AcWzw/kzM8/oLqoMSdWXIY9SAhrHQA==
X-WBNR-Posting-Host: 69.159.134.162
From: "=?Utf-8?B?RGFueSBDLg==?=" <dc********@newsgroups.nospam>
References: <40**********************************@microsoft.co m>
<LU**************@TK2MSFTNGXA01.phx.gbl>
Subject: RE: Problem with SSL with a sub domain
Date: Wed, 7 Sep 2005 08:51:13 -0700
Lines: 94
Message-ID: <C7**********************************@microsoft.co m>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Utf-8"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
Newsgroups: microsoft.public.dotnet.framework.webservices
NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl
microsoft.public.dotnet.framework.webservices:7814
X-Tomcat-NG: microsoft.public.dotnet.framework.webservices

Thank Steven for your welcome note.

You were right in your assumptions. We have created an aspx as mentionned. When we access the https:\\ws.mycompany.com\helloword.aspx we have this
security alert popup:

-The name on the certificate is invalid or does not match the name of the
site!
-Certificate is from a trusted authority
-Certificatace is valid

We have the option to proceed or not.

--
Dany Couillard, ing.
"Steven Cheng[MSFT]" wrote:

Hi Dany,

Welcome to MSDN newsgroup.
From your description, the problem occurs when you accessing the remote
webservice through the subdomain url and the webserver's server
certificated is obtained through the top domain name. I think we can try the following test to confirm whether the problem is caused by the
inconsistent of the certificate issue name and the webserver's site
name(sub domain name):

1. create an asp.net webpage(not asmx webservice) under the web site which

used SSL protection and is available through sub domain url.

2. At clientside use IE to request that page through https url (sub

domain

name) to see whether the page can be viewed directly or will occur a

dialog

indicate that there has some thing wrong with the serverside certificate. I

f the dialog popup, that means the clientside found the certificate
inconsistent with the site's name. Since when calling the webservice
programmatically, there hasn't means for us to suppress such warning

like we interactivly in IE, so there may lead to a connection failed

exception.

Please have a check and let me know if this is the problem so that we can continue to do some further invesigation.

Thanks,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)
--------------------
Thread-Topic: Problem with SSL with a sub domain
thread-index: AcWzQRoyyWc7+S+lQJitPF0V8tFS9g==
X-WBNR-Posting-Host: 69.159.133.147
From: "=?Utf-8?B?RGFueSBDLg==?=" <dc********@newsgroups.nospam>
Subject: Problem with SSL with a sub domain
Date: Tue, 6 Sep 2005 17:14:24 -0700
Lines: 13
Message-ID: <40**********************************@microsoft.co m>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Utf-8"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
Newsgroups: microsoft.public.dotnet.framework.webservices
NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFT NGXA03.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl
microsoft.public.dotnet.framework.webservices:7798
X-Tomcat-NG: microsoft.public.dotnet.framework.webservices

We have install a valid SSL certificate issued to www.mycompany.com on

our

web server running IIS 6.0 / win2003 SP1. Then we have created a sub
domain
pointing to the same server for our web services at ws.mycompany.com. We have
properly installed the server certificate on the client machine.

When the client try to connect to our secure webservice at
https:\\ws.mycompany.com we have the foolwing error:

System.Net.WebException: The underlying connection was closed: Could not establish trust relationship with remote server.

--
Dany Couillard, ing