Select the product you need help with
- Internet Explorer
- Windows Phone
- More products
FIX: You cannot use a different SSL certificate for each array member in an ISA Server 2004, Enterprise Edition-based array
Article ID: 898066 - View products that this article applies to.
Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/256986/ )Description of the Microsoft Windows registry
You cannot configure a different Secure Socket Layer (SSL) certificate for each enterprise array member server in a Microsoft Internet Security and Acceleration (ISA) Server 2004, Enterprise Edition-based array.
Consider the following scenario. You configure an ISA Server 2004, Enterprise Edition-based server that uses SSL to help protect HTTP connections. When you configure the Web listener to listen to an SSL connection, you must select a certificate that is installed and shared on all the array members.
Additionally, when you use an SSL hardware accelerator for each member server in the array, each accelerator will have a unique certificate.
However, ISA Server 2004, Enterprise Edition requires that you use the same certificate for all member servers in the array.
ISA Server 2004, Enterprise Edition does not support assignment of multiple Web listeners for Web publishing. You cannot configure multiple Web listeners that use a different certificate for each Web listener and then assign each Web listener to a Web publishing rule.
Service pack informationTo resolve this problem, obtain the latest service pack for Internet Security and Acceleration Server 2004. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/891024/ )How to obtain the latest ISA Server 2004 service pack
Hotfix InformationA supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem.
If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, submit a request to Microsoft Customer Service and Support to obtain the hotfix.
Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:
http://support.microsoft.com/contactus/?ws=supportNote The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.
PrerequisitesYou must restart the Firewall service.
Restart requirementYou do not have to restart the computer after you apply this hotfix.
Hotfix replacement informationThis hotfix does not replace any other hotfixes.
File InformationThe English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
Date Time Version Size File name --------------------------------------------------------- 15-May-2005 06:26 4.0.3440.267 2,382,616 Msfpcui.dll 15-May-2005 06:26 4.0.3440.267 4,601,112 Msfpcsnp.dll 15-May-2005 06:26 4.0.3440.267 394,008 Msphlpr.dll 15-May-2005 06:26 4.0.3440.267 663,320 W3filter.dll
Registry entry requirementWarning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.
After you apply the hotfix, ISA Server 2004, Enterprise Edition will support a new registry entry that is named AllowPerServercertificate. You must add this registry entry to the following registry subkey:
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section. This problem was first corrected in Internet Security and Acceleration Server 2004 Service Pack 2.
After you apply the hotfix and add the AllowPerServercertificate registry entry, a list of certificates that are available on the specified member server in the array now appears on the Web proxy listener wizard. This list also appears in the properties of the Web proxy reverse listener.
To select a certificate for each member server in the array, follow these steps:
885957For more information about the terms that are used to describe software updates, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/885957/ )How to install ISA Server hotfixes and updates
(http://support.microsoft.com/kb/824684/ )Description of the standard terminology that is used to describe Microsoft software updates