Microsoft KB Archive/247098

= How To Install and Reload the SSL Filter Sspifilt.dll =

Article ID: 247098

Article Last Modified on 11/21/2006

-

APPLIES TO


 * Microsoft Internet Information Server 3.0
 * Microsoft Internet Information Server 4.0
 * Microsoft Internet Information Services 5.0
 * Microsoft Internet Information Services 5.1

-



This article was previously published under Q247098



We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 6.0 running on Microsoft Windows Server 2003. IIS 6.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/prodtech/IIS.mspx



IN THIS TASK
SUMMARY Install the Filter
 * IIS 4.0 and 5.0
 * IIS 5.1

Reload the Filter Troubleshooting REFERENCES



SUMMARY
This step-by-step article describes how to install or reload the Secure Sockets Layer (SSL) filter to turn on SSL for Web sites.

back to the top

Install the Filter
The Web sites must have the Sspifilt.dll file loaded. By default, this filter is installed with the Microsoft Windows NT 4.0 Option Pack for Internet Information Server (IIS) 4.0, when you install Internet Information Services (IIS) 5.0 on Microsoft Windows 2000, and when you install IIS 5.1 on Microsoft Windows XP Professional. To find this filter, enumerate the master properties in the Microsoft Management Console (MMC).

To verify the status of Sspifilt.dll, follow these steps:

back to the top

IIS 4.0 and 5.0

 * 1) In the MMC, under Internet Information Services, right-click   and then click Properties.
 * 2) In the Master Properties section, click WWW Service, and then click Edit.
 * 3) On the ISAPI Filters tab, notice the direction and color of the arrow:
 * 4) * If the arrow is green and pointing up, the filter is loaded correctly.
 * 5) * If the arrow is red and pointing down, the filter is not loaded. SSL will not work on this server until this problem is corrected.

back to the top

IIS 5.1

 * 1) In the MMC, under Internet Information Services, right-click Web Sites and then click Properties.
 * 2) On the ISAPI Filters tab, notice the direction and color of the arrow:
 * 3) * If the arrow is green and pointing up, the filter is loaded correctly.
 * 4) * If the arrow is red and pointing down, the filter is not loaded. SSL will not work on this server until this problem is corrected.

If you find that the filter is not loaded, follow the steps in the Reload section to correct this problem.

back to the top

Reload the Filter
To reload the Sspifilt.dll filter, follow these steps:  Remove Sspifilt.dll from the master properties. (To access the master properties, see the steps in the Installation section). At a command prompt, type the following command to stop IIS and its dependent services:

net stop iisadmin /y

 At a command prompt, type the following command to restart IIS and its dependent services:

net start w3svc

 Open the master properties for the IIS server. On the ISAPI filters tab, click Add. Type SSPIFILT for the name and C:\% %\System32\Inetsrv\Sspifilt.dll for the path. By default, the status shows Unknown. Stop and restart IIS and its dependent services (see steps 2 and 3).</li></ol>

If these steps prove unsuccessful, see the steps in the Troubleshooting section.

back to the top

Troubleshooting
<ol> Check the permissions on the C:\% %\System32\Intersrv folder. By default, Everyone has Change permissions; the Creator, Owner, Administrators, and System have Full Control permissions.</li> At a command prompt, use the cd command to change to the C:\% %\System32\Inetsrv\Adminsamples directory, and then type the following command to check the values that are stored in the metabase:

adsutil enum\filters

The following output is returned:

<pre class="fixed_text">KeyType              :(String)  "IISFilters" FilterLoadOrder      :(String)  "sspifilt" [/w3svc/filters/sspifilt]

</li> If this output is correct, check the values on the specific location, W3svc/Filters/Sspifilt. To do this, type the following command at a command prompt to enumerate the metabase:

adsutil enum w3svc/filters/sspifilt

This returns the following output:

<pre class="fixed_text">FilterState          :(Integer) 1 (this state shows the filter enabled)

</li></ol>

If this procedure is not successful:

For IIS 3.0: Remove and then reinstall IIS 3.0. For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

184309 How to Install IIS Without Rerunning Windows NT Setup

For IIS 4.0: Remove and then reinstall the Windows NT 4.0 Option Pack. For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

187870 How To How to Remove and Reinstall the Windows NT 4.0 Option Pack

For IIS 5.0 and 5.1: Remove and then reinstall IIS. For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

325889 How To Remove and Reinstall IIS 5.0 and 5.1

NOTE: For IIS 4.0, 5.0 and 5.1, you must back up the configuration of IIS before you remove it, so that you can restore that configuration after the reinstallation. For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

302573 How To Back Up and Restore IIS

back to the top

<div class="references_section">