FIX: You cannot use a different SSL certificate for each array member in an ISA Server 2004, Enterprise Edition-based array

Article ID: 898066 - View products that this article applies to.
Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986
(http://support.microsoft.com/kb/256986/ )
Description of the Microsoft Windows registry
Expand all | Collapse all

On This Page

SYMPTOMS

You cannot configure a different Secure Socket Layer (SSL) certificate for each enterprise array member server in a Microsoft Internet Security and Acceleration (ISA) Server 2004, Enterprise Edition-based array.

Consider the following scenario. You configure an ISA Server 2004, Enterprise Edition-based server that uses SSL to help protect HTTP connections. When you configure the Web listener to listen to an SSL connection, you must select a certificate that is installed and shared on all the array members.

Additionally, when you use an SSL hardware accelerator for each member server in the array, each accelerator will have a unique certificate.

However, ISA Server 2004, Enterprise Edition requires that you use the same certificate for all member servers in the array.
Back to the top | Give Feedback

CAUSE

ISA Server 2004, Enterprise Edition does not support assignment of multiple Web listeners for Web publishing. You cannot configure multiple Web listeners that use a different certificate for each Web listener and then assign each Web listener to a Web publishing rule.
Back to the top | Give Feedback

RESOLUTION

Service pack information

To resolve this problem, obtain the latest service pack for Internet Security and Acceleration Server 2004. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
891024
(http://support.microsoft.com/kb/891024/ )
How to obtain the latest ISA Server 2004 service pack

Hotfix Information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, submit a request to Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:
http://support.microsoft.com/contactus/?ws=support
(http://support.microsoft.com/contactus/?ws=support)
Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

You must restart the Firewall service.

Restart requirement

You do not have to restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File Information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
   Date         Time   Version       Size       File name
   ---------------------------------------------------------
   15-May-2005  06:26  4.0.3440.267  2,382,616  Msfpcui.dll
   15-May-2005  06:26  4.0.3440.267  4,601,112  Msfpcsnp.dll
   15-May-2005  06:26  4.0.3440.267    394,008  Msphlpr.dll
   15-May-2005  06:26  4.0.3440.267    663,320  W3filter.dll

Registry entry requirement

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

After you apply the hotfix, ISA Server 2004, Enterprise Edition will support a new registry entry that is named AllowPerServercertificate. You must add this registry entry to the following registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fpc\w3proxy
Notes
  • You must apply the hotfix on all servers that are members of the ISA Server 2004, Enterprise Edition-based array. Additionally, you must add the AllowPerServercertificate registry entry on all the servers that are members of the ISA Server 2004, Enterprise Edition-based array.
  • Make sure that the Firewall service is stopped before you add the registry entry. Restart the Firewall service after you add the registry entry.
  • If the
    w3proxy
    registry subkey is not found, you must create the
    w3proxy
    registry subkey.
To add the AllowPerServercertificate registry entry, follow these steps:
  1. Click Start, click Run, type regedit in the Open box, and then click OK.
  2. Locate and then click the following registry subkey:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fpc\w3proxy
  3. On the Edit menu, point to New, and then click DWORD Value.
  4. Type AllowPerServercertificate, and then press ENTER.
  5. Right-click AllowPerServercertificate, and then click Modify
  6. Type 1 in the Value data box, and then click OK.
  7. Quit Registry Editor.
  8. After you add the AllowPerServercertificate Registry entry, restart the Firewall service.
Back to the top | Give Feedback

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section. This problem was first corrected in Internet Security and Acceleration Server 2004 Service Pack 2.
Back to the top | Give Feedback

MORE INFORMATION

After you apply the hotfix and add the AllowPerServercertificate registry entry, a list of certificates that are available on the specified member server in the array now appears on the Web proxy listener wizard. This list also appears in the properties of the Web proxy reverse listener.

To select a certificate for each member server in the array, follow these steps:
  1. Open the ISA Server Management snap-in, and then expand Arrays.
  2. Expand ArrayName, and then click Firewall Policy (ArrayName).
  3. In the right pane, click New, and then click Web Listener.
  4. In the New Web Listener Definition Wizard, type a name for the Web listener in the Web Listener name box, and then click Next.
  5. On the IP Addresses page, select the appropriate network and the associated IPs, and then click Next.
  6. On the Port Specification page, select the Enable SSL check box, and then click Select.
  7. In the Select Server Certificates dialog box, click the name of the member server in the array to which you want to assign a certificate, and then click Next.
  8. In the Certificates list, select a certificate for the member server, and then click OK.
  9. Make sure that the certificate that you selected in step 8 appears in the Select Server Certificates dialog box, and then click OK.
  10. Click Next.
  11. On the Completing the New Web Listener Wizard page, make sure that the configuration for the new Web listener that you created is correct, and then click Finish.
If you want to configure an existing Web listener to use a certificate, follow these steps:
  1. Open the ISA Server Management snap-in, and then expand Arrays.
  2. Expand ArrayName, and then click Firewall Policy (ArrayName).
  3. In the right pane, expand Web Listeners, right-click the Web listener that you want to configure, and then click Properties.
  4. On the Preferences tab, click the Enable SSL check box, and then click Select.
  5. In the Select Server Certificates dialog box, click the name of the member server in the array to which you want to assign a certificate, and then click Next.
  6. In the Certificates list, select a certificate for the member server, and then click OK.
  7. Make sure that the certificate that you selected in step 6 appears in the Select Server Certificates dialog box, and then click OK.
  8. Click Apply, and then click OK.
For more information about how to install ISA Server 2004 hotfixes and updates, click the following article number to view the article in the Microsoft Knowledge Base:
885957
(http://support.microsoft.com/kb/885957/ )
How to install ISA Server hotfixes and updates
For more information about the terms that are used to describe software updates, click the following article number to view the article in the Microsoft Knowledge Base:
824684
(http://support.microsoft.com/kb/824684/ )
Description of the standard terminology that is used to describe Microsoft software updates
Back to the top | Give Feedback

Properties

Article ID: 898066 - Last Review: December 4, 2007 - Revision: 4.7
APPLIES TO
  • Microsoft Internet Security and Acceleration Server 2004 Enterprise Edition
Keywords: 
kbautohotfix kbbug kbfix kbqfe kbhotfixserver KB898066
Back to the top | Give Feedback

Give Feedback

 
Back to the topBack to the top