Using SSL certificate with Nav service - FQDN vs local

martin78

Hi,

I have an Nav 2016 service that runs with an untrusted SSL (Navhost1.dom.local)
Credential type Username.

Works just fine - but the clients needs to have the certificate imported I order to start and logon the Navision client/server.
On the Nav server the SSL needs to have the computername (Navhost1.dom.local) in order to start.

But what do I do if I want to use an globaly trusted SSL for example Navhost1.mydomain.com?
Do I need to rename my navserver and windows domain?

Have tried to use split DNS. Created an new zone mydomain.com with the host Navhost1 pointing to IP.
Does not work.

Can not find any info regarding this.

Best regards
Martin

Jan_Veenendaal

No you don't have to rename your server, nor the windows domain.

Global steps:
1. Import the SSL certificate in the certificate store of your server
2. In the certificate store, grant permissions to the Account that is used by you NAV Service to use the certificate
3. Set up the DNS (as you already did)
4. In the clients ClientUserSettings.config the servername AND the 'DnsIdentity' keys need to match to the certificate's name.

You can find documentation on msdn: https://msdn.microsoft.com/en-us/library/gg502467(v=nav.90).aspx

martin78

Hi Jan,

Thank you for your answer.

When starting Navservice with the (globally) tusted SSL, I receive this error:


Message:
The security certificate that has the provided 'ServicesCertificateThumbprint' is not valid.
Description = '[Subject]
CN=Navhost1.mydomain.com, OU=Domain Control Validated, C=DK

What can be the reason?
The cert is an "Alpha SSL" but do I need to choose an deferent type of certificate?

Best regards
Martin

Jan_Veenendaal

Navhost1.mydomain.com <-- this should be your actual server public name; I guess that is the case, but that you changed it here.

You could also test your certificate by using it for a website (on the same server, preferably).

martin78

Hi Jan,

If I "ping" Navhost1.mydomain.com, on the NAV server, the NAV servers local IP is responding.
If I ping from outside, my public WAN IP is responding.

But why cant I start the NAV service, with this certificate?
What "checks" does the NAV service do prior starting?

Jan_Veenendaal

What I suggested is: if you have IIS running on the same machine, try to add a binding to the default website using the HTTPS protocol, and select your certificate there <- that should be possible.

If you cannot select the certificate than probably the certificate is in the wrong certificate store.
If you can select the certificate, and the certificate is not valid [as NAV suggests] then possibly IIS will give a more detailed error message.
If you can select the certificate and everything is fine on IIS, then check if the Service Account that is used by the NAV service has permissions on the certificate ( go to 'manage computer certificates', select your certificate, right click, click 'All Tasks', 'Manage Private Keys')

martin78

Hi Jan,

Thank you for your answers.

I have IIS on the same server, and have just tested.
I can choose and use the trudsted SSL. I can also type in the external SSL name, and enter IIS' default site.
( No SSL warnings).

The service user, NAV service is running with, have "full control".

But can not start the NAV service.

What about "certificate purposes" ?
All purposes is enabled but this certificate only have "server authentication" and "client authentication".
Can this be the reason?
A self generated have a lot more purposes...

Best regards
Martin

Jan_Veenendaal

We are using a certificate, issued by COMODO, that has only the same two 'purposes' and that works fine.

Do you get any error messages in the Windows Event Log ?

martin78

Strange.

I have this in the application log:


Message:
The security certificate that has the provided 'ServicesCertificateThumbprint' is not valid.
Description = '[Subject]
CN=Navhost1.mydomain.com, OU=Domain Control Validated, C=DK

[Issuer]
CN=AlphaSSL CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE