Ssl – IIS ARR ReverseProxy with Client Certificate Authentication for backend IIS

asp.nethttpsiisreverse-proxyssl

We have legacy SOAP Web Services (https://dev-ms01/Services/default.asmx) which are written in asp.net 1.1 hosted on IIS7(win server 2008 standard),web services consumed by clients by providing Client Certificate. For the SSL Certificates settings we have Accept on this IIS

`Client(Request with SSL Client Certificate)--> IIS7 (on host dev-ms01)--> Asp.Net SOAP WebServices`

Now I'm trying to set up proxy IIS(IIS10 on win server 2016 64bit host secure-dev-ms01) with revere proxy for the IIS7. I've followed msdn article https://blogs.msdn.microsoft.com/friis/2016/08/25/setup-iis-with-url-rewrite-as-a-reverse-proxy-for-real-world-apps/ to configure URL rewrite with ReverseProxy as below

`Client(Request with SSL Client Certificate)--> Proxy IIS10 Server with ReverseProxy (on host secure-dev-ms01)--> IIS7 (on host dev-ms01) --> Asp.Net SOAP WebServices`

On the IIS10(host secure-dev-ms01) for the SSL Certificates settings I've chosen Accept and I've tried the below ReverseProxy configuration . When I'm trying to browse the proxy web services URL as https://secure-dev-ms01/Services/default.asmx it is prompting the client certificate but after providing the client certificate am seeing below error

403 - Forbidden: Access is denied.
You do not have permission to view this directory or page using the credentials that you supplied.

I've tried using below RevereProxy as well and tried browsing the proxy web services URL https://secure-dev-ms01/Services/default.asmx and provided the client certificate but still am seeing below error. I've also tried unchecking the option Enable SSL Offloading for both of the above RevereseProxy configurations, but that didnt work either

403 - Forbidden: Access is denied.
You do not have permission to view this directory or page using the credentials that you supplied.

I found this msdn article https://blogs.msdn.microsoft.com/asiatech/2014/01/27/configuring-arr-with-client-certificate/ which suggests changingSSL Certificates settings to Ignore on the backend server(but we can not adopt this for our organization) and try using the certificate from the headers X-ARR-ClientCert but we are trying to avoid making any code changes to the legacy asp.net 1.1 services

I couldnt find any relevant articles that could make IIS ARR ReverseProxy with Client Certificate Authentication work for backend IIS with just configuration tweaks on the IIS10 with ReverseProxy instead of code/config change on the backend IIS7, can someone please help me to make this work?

Best Answer

I assume you have IIS7 (on host dev-ms01) machine in a secured network with no direct access from the Internet.

In this case, you need to enable SSL offloading and client certificate authentication on Proxy IIS10 Server with ReverseProxy (on host secure-dev-ms01) only and disable SSL offloading and certificate auth in IIS7.

In this scheme, IIS10 is responsible for the SSL handshake and certificate validation. It places the certificate (POM) into X-ARR-ClientCert header and proxy-passes requests to IIS7 via plain HTTP including this header. Probably you need to setup by-passing of X-Forwarded-For, X-Forwarded-Proto, X-Forwarded-Schema and X-Forwarded-Host headers on IIS10, in the rewrite URL rule, if your ASP services have any use for them.

So, for your IIS10 server:

enable ARR
add a rewrite URL rule to proxy-pass to IIS7
setup by-passing of the headers above in the rewrite rule
add a server certificate
require SSL in the SSL settings of the Default Web Site
set the client certificates setting equal to Accept
enable anonymous authentication for your site
setup https bindings with the server certificate

For the IIS7 server:

disable HTTPS bindings
do not require SSL
do not require client certificates

Hopefully, you'll get the next scheme working

Browser ---[HTTPS]---> IIS10 --[HTTP + headers]--> IIS7

where headers are X-ARR-ClientCert, X-Forwarded-For, X-Forwarded-Proto, X-Forwarded-Schema, and X-Forwarded-Host.

Related Solutions

Iis – Configuring IIS ARR for backend client certificate authentication

Chances are Microsoft ARR is using CAPI to store its certificates, but there are no guarantee that ARR will use it even if you make the certificate available to it. Client side authentication requires extra code, and your requirements are not that common. It could have been overlooked and left behind...

To make your client certificate available to a service, you have to edit its "MY" CAPI store. Run mmc.exe from an elevated prompt and add the certificate snap-in. You will have to select which CAPI store to use. Select the computer's store. Import your certificate in the "Personal certificates", making sure you imported the private key with it (it will say so when you go back and view the certificate you imported).

If adding your certificate to the computer store does not work, try the service store. This will be required if ARR runs with its own identity.

I also had an issue with AD-LDS where the service did not have read access to the private key. This article was helpful, but it might be too far off for ARR. Look for ADAM special case in that page, the command you are looking for is

Certutil –V –Verifystore MY 0

Ssl – getting a 502 error with ARR only when SSL is enabled

Let me answer my own question... I disabled "Require Server Name Indication" and suddenly everything worked. This is weird because SNI was enabled on all servers in the farm for the same site but for one of them, unchecking it made it all work. My theory is this: Even with shared config, SSL binding information doesn't really transfer from one server to the other, from the IP to the certificate. As many of you know, you still have to manually go to the other server and select the certificate. So that was a clue about how the setups could be different. I actually believe the setups were the same visually but somewhere under the hood something was different for one binding somehow. Anyway, I spent hours on this issue and nowhere did I read anything about "Require Server Name Indication" being related to a 502 error. So I wanted to share with the internet community so that future people will know to look at that setting if they are stuck with a 502 error when using SSL. Maybe there is a way to keep it enabled, since it was working on the rest of my farm, but at the very least you'll know in what area you might need to be looking to solve your 502 error. Of course, remember that the first cause of 502 errors in my opinion is not having the certificate installed on all servers when not using SSL offloading but that was not my issue, and mine was unique in that just one server in a farm was misbehaving with SSL enabled. I hope this helps someone else.

Best Answer

Related Solutions

Iis – Configuring IIS ARR for backend client certificate authentication

Ssl – getting a 502 error with ARR only when SSL is enabled

Related Topic