[RESOLVED] Moving to SSL

[kxcntry99]

Everyone,

I have been developing a web application for some time now and it has become time to put it into production. I have done many uploads to production but as this is the final one I need to implement an SSL connection. I run my own webserver so it has been easy from the point that I have 100% access to the system. At this point I have gotten my 3rd party cert and installed it on the server. I have setup everything to the point that I can bring up my apps login page and see that it is under https://xxx....

The problem is that once I log in I get a server error. I examined the stack trace and it is getting hung up on one of my sql statements. This didn't come up before so I moved the site back to traditional http: and dropped the SSL. After doing so I logged in just fine. Wet back to SSL and got the error again.

What the post comes down to is, what other changes would I need to make in my project to use SSL. Until now it was my understanding that SSL was just a way to verify and encrypt the information between my webserver and the client. With this error it doesn't appear so. What am I missing???

[gep13]

Hey,

What version of IIS are you deploying to?

Also, in terms of logging into your application, are you using the built in ASP.Net Membership providers, or are you using your own authentication mechanism?

There shouldn't be "too" much involved in enabled SSL for your application, so I am curious about the exact error message that was thrown?!?

Can you post it here?

Gary

[kxcntry99]

its being deployed to IIS 6 and I am using the built in membership providers. I seem to be able to be logged in but the second step of the app is a SQL statement I created to pull some additional info out of the mebmership db. I found it easier to make my own query to the membership userstore. The stack trace just points to the line where I call on my vb class to pull the additional data:



[NullReferenceException: Object reference not set to an instance of an object.]
UDA.GetID(Int32 UserID) +152
Login.authenticateUser() +158

[gep13]

Hey,

I don't think that the null reference exception has anything to do with the fact that you are using SSL.

Are the databases that you are using in production exactly the same as they are in development. Is it possible that there is something missing from the production database, that you code is expecting and not finding, i.e. causing the null reference?

Gary

[kxcntry99]

I don't know where it would be coming from then because if I set the site up without ssl it works fine. Same server, same database, same data, same code.

[kxcntry99]

do my page redirects need to indicate its now an SSL site???

[gep13]

Hmmm, that is very interesting....

Have you got logging in your application? Do you know exactly what is happening in your application at the point of failure?

If it possible to debug your application in production?

Incase you haven't seen them, these are the steps you would need to take to set up SSL:

http://msdn.microsoft.com/en-us/library/aa302411.aspx

One other thing, are there any steps in your code that redirect to something starting with "http", if there are, you would need to change this to be "https".

Gary

[gep13]

do my page redirects need to indicate its now an SSL site???

See the end of my last post.

Yes, they would.

Gary

[kxcntry99]

Here is my redirect URL after login succeeds do you see any problem here:

defaultUrl="~/Secure/Common/Forms/Home.aspx"

[gep13]

Hey,

In this case, I suspect that an absolute path may be required.

Out of curiosity, can you try the redirect to the full url?

Gary

[kxcntry99]

just did....same results

[kxcntry99]

interesting...so I just tried something unorthadox. I logged in to the app while I had it in http mode. I coded the site to write an auth cookie if logged in correctly. After I logged in in http I moved the site back to https. The cookie was still there and when I put in a full path with https the app works fine!??!?!

It must be something in the login procedure that when in SSL mode it doesn't like. I will setup some logging and see exactly where it is hung up in SSL mode. Weird!?!??!

[gep13]

Interesting...

I can't say that I have used the Membership Provider over SSL.

There is a setting in the web.config file that you may want to look into - requireSSL:

http://msdn.microsoft.com/en-us/library/ms998347.aspx

Gary

[kxcntry99]

Ok now I really don't get it.

After I logged in under no SSL then before the cookie expired, changed the site to SSL and opened a new IE instance pasted a full url to a page I knew was in the app itself. It works. I tested it on the web server then tested it from a workstation outside the DMZ. I don't know what happened but it looks like it is working now.

[kxcntry99]

There is a setting in the web.config file that you may want to look into - requireSSL:

http://msdn.microsoft.com/en-us/library/ms998347.aspx

Gary

I am almost afraid to change anything now that I got it working

[gep13]

I am almost afraid to change anything now that I got it working

Hey,

I know that feeling, but I think this deserves some more investigation.

Can you try logging in on a machine that hasn't hit that website before?

Gary

[kxcntry99]

Can you try logging in on a machine that hasn't hit that website before?

Gary

ever? or since its been SSL'd

[gep13]

Ideally ever.

Basically trying to rule out that something hasn't happened with you changing between SSL and back again has "fixed" the issue, but that you will see it again on fresh machines.

Gary

[kxcntry99]

hmmmm....I don't know that I have access to a computer that hasn't ever been on the site. I just tried it on a workstation that hasn't ever tried since it went to SSL and it worked.

[gep13]

Hey,

Ok, so on that basis, it might be that you are good to go then.

I personally would still like to do a test on a fresh machine, but that is maybe just my paranoia

Gary

[kxcntry99]

I'm with you. I will see if I can test tomorrow on a fresh machine and see what happends. I will also clear all my cookies and temp internet files and try again from one of my machines here. Thanks for the help.

[gep13]

Hey,

That is a good idea!!

Let me know how you get on, will be interesting to see how this pans out.

Gary

[kxcntry99]

Ok, so I am not sure what happened there but I logged on just fine on a completely freash machine this AM. I don't know what was missing but when I logged in under non-SSL, setup the site as SSL and navigated to a page in the membership secured section, it worked just fine. Every computer since then has worked by going through the normal procedure of logging in under SSL and going to the first page just fine.

I am going to mark this thread as resolved but I am weary of our next deployment of the site. Hopefully everything will workout then too but, we shall see

[gep13]

Hey,

Well I am glad it is working anyway, and fingers crossed for the next one!!

Gary