Knowledge Base

FIX: You cannot use a different SSL certificate for each array member in an ISA Server 2004, Enterprise Edition-based array

Article ID: 898066

Article Last Modified on 12/4/2007

APPLIES TO

Microsoft Internet Security and Acceleration Server 2004 Enterprise Edition

Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows registry

SYMPTOMS

You cannot configure a different Secure Socket Layer (SSL) certificate for each enterprise array member server in a Microsoft Internet Security and Acceleration (ISA) Server 2004, Enterprise Edition-based array.

Consider the following scenario. You configure an ISA Server 2004, Enterprise Edition-based server that uses SSL to help protect HTTP connections. When you configure the Web listener to listen to an SSL connection, you must select a certificate that is installed and shared on all the array members.

Additionally, when you use an SSL hardware accelerator for each member server in the array, each accelerator will have a unique certificate.

However, ISA Server 2004, Enterprise Edition requires that you use the same certificate for all member servers in the array.

CAUSE

ISA Server 2004, Enterprise Edition does not support assignment of multiple Web listeners for Web publishing. You cannot configure multiple Web listeners that use a different certificate for each Web listener and then assign each Web listener to a Web publishing rule.

RESOLUTION

Service pack information

To resolve this problem, obtain the latest service pack for Internet Security and Acceleration Server 2004. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

891024 How to obtain the latest ISA Server 2004 service pack

Hotfix Information

A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that this article describes. Apply this hotfix only to systems that are experiencing this specific problem.

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:

http://go.microsoft.com/?linkid=6294451

Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Prerequisites

You must restart the Firewall service.

Restart requirement

You do not have to restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File Information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

   Date         Time   Version       Size       File name
   ---------------------------------------------------------
   15-May-2005  06:26  4.0.3440.267  2,382,616  Msfpcui.dll
   15-May-2005  06:26  4.0.3440.267  4,601,112  Msfpcsnp.dll
   15-May-2005  06:26  4.0.3440.267    394,008  Msphlpr.dll
   15-May-2005  06:26  4.0.3440.267    663,320  W3filter.dll

Registry entry requirement

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

After you apply the hotfix, ISA Server 2004, Enterprise Edition will support a new registry entry that is named AllowPerServercertificate. You must add this registry entry to the following registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fpc\w3proxy

Notes

You must apply the hotfix on all servers that are members of the ISA Server 2004, Enterprise Edition-based array. Additionally, you must add the AllowPerServercertificate registry entry on all the servers that are members of the ISA Server 2004, Enterprise Edition-based array.
Make sure that the Firewall service is stopped before you add the registry entry. Restart the Firewall service after you add the registry entry.
If the w3proxy registry subkey is not found, you must create the w3proxy registry subkey.

To add the AllowPerServercertificate registry entry, follow these steps:

Click Start, click Run, type regedit in the Open box, and then click OK.
Locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fpc\w3proxy
On the Edit menu, point to New, and then click DWORD Value.
Type AllowPerServercertificate, and then press ENTER.
Right-click AllowPerServercertificate, and then click Modify
Type 1 in the Value data box, and then click OK.
Quit Registry Editor.
After you add the AllowPerServercertificate Registry entry, restart the Firewall service.

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section. This problem was first corrected in Internet Security and Acceleration Server 2004 Service Pack 2.

MORE INFORMATION

After you apply the hotfix and add the AllowPerServercertificate registry entry, a list of certificates that are available on the specified member server in the array now appears on the Web proxy listener wizard. This list also appears in the properties of the Web proxy reverse listener.

To select a certificate for each member server in the array, follow these steps:

Open the ISA Server Management snap-in, and then expand Arrays.
Expand ArrayName, and then click Firewall Policy (ArrayName).
In the right pane, click New, and then click Web Listener.
In the New Web Listener Definition Wizard, type a name for the Web listener in the Web Listener name box, and then click Next.
On the IP Addresses page, select the appropriate network and the associated IPs, and then click Next.
On the Port Specification page, select the Enable SSL check box, and then click Select.
In the Select Server Certificates dialog box, click the name of the member server in the array to which you want to assign a certificate, and then click Next.
In the Certificates list, select a certificate for the member server, and then click OK.
Make sure that the certificate that you selected in step 8 appears in the Select Server Certificates dialog box, and then click OK.
Click Next.
On the Completing the New Web Listener Wizard page, make sure that the configuration for the new Web listener that you created is correct, and then click Finish.

If you want to configure an existing Web listener to use a certificate, follow these steps:

Open the ISA Server Management snap-in, and then expand Arrays.
Expand ArrayName, and then click Firewall Policy (ArrayName).
In the right pane, expand Web Listeners, right-click the Web listener that you want to configure, and then click Properties.
On the Preferences tab, click the Enable SSL check box, and then click Select.
In the Select Server Certificates dialog box, click the name of the member server in the array to which you want to assign a certificate, and then click Next.
In the Certificates list, select a certificate for the member server, and then click OK.
Make sure that the certificate that you selected in step 6 appears in the Select Server Certificates dialog box, and then click OK.
Click Apply, and then click OK.

For more information about how to install ISA Server 2004 hotfixes and updates, click the following article number to view the article in the Microsoft Knowledge Base:

885957 How to install ISA Server hotfixes and updates

For more information about the terms that are used to describe software updates, click the following article number to view the article in the Microsoft Knowledge Base:

824684 Description of the standard terminology that is used to describe Microsoft software updates

Keywords: kbbug kbfix kbqfe kbhotfixserver KB898066

Microsoft KB Archive/898066

Contents