mibuso.com
Home› NAV Three Tier
Options

Using SSL certificate with Nav service - FQDN vs local

martin78martin78 Member Posts: 5
in NAV Three Tier
Hi,

I have an Nav 2016 service that runs with an untrusted SSL (Navhost1.dom.local)
Credential type Username.

Works just fine - but the clients needs to have the certificate imported I order to start and logon the Navision client/server.
On the Nav server the SSL needs to have the computername (Navhost1.dom.local) in order to start.

But what do I do if I want to use an globaly trusted SSL for example Navhost1.mydomain.com?
Do I need to rename my navserver and windows domain?

Have tried to use split DNS. Created an new zone mydomain.com with the host Navhost1 pointing to IP.
Does not work.

Can not find any info regarding this.

Best regards
Martin

Answers

  • Options
    Jan_VeenendaalJan_Veenendaal Member Posts: 206
    No you don't have to rename your server, nor the windows domain.

    Global steps:
    1. Import the SSL certificate in the certificate store of your server
    2. In the certificate store, grant permissions to the Account that is used by you NAV Service to use the certificate
    3. Set up the DNS (as you already did)
    4. In the clients ClientUserSettings.config the servername AND the 'DnsIdentity' keys need to match to the certificate's name.

    You can find documentation on msdn: https://msdn.microsoft.com/en-us/library/gg502467(v=nav.90).aspx
    Jan Veenendaal
  • Options
    martin78martin78 Member Posts: 5
    Hi Jan,

    Thank you for your answer.

    When starting Navservice with the (globally) tusted SSL, I receive this error:


    Message:
    The security certificate that has the provided 'ServicesCertificateThumbprint' is not valid.
    Description = '[Subject]
    CN=Navhost1.mydomain.com, OU=Domain Control Validated, C=DK

    What can be the reason?
    The cert is an "Alpha SSL" but do I need to choose an deferent type of certificate?

    Best regards
    Martin





  • Options
    Jan_VeenendaalJan_Veenendaal Member Posts: 206
    Navhost1.mydomain.com <-- this should be your actual server public name; I guess that is the case, but that you changed it here.

    You could also test your certificate by using it for a website (on the same server, preferably).

    Jan Veenendaal
  • Options
    martin78martin78 Member Posts: 5
    Hi Jan,

    If I "ping" Navhost1.mydomain.com, on the NAV server, the NAV servers local IP is responding.
    If I ping from outside, my public WAN IP is responding.

    But why cant I start the NAV service, with this certificate?
    What "checks" does the NAV service do prior starting?



  • Options
    Jan_VeenendaalJan_Veenendaal Member Posts: 206
    What I suggested is: if you have IIS running on the same machine, try to add a binding to the default website using the HTTPS protocol, and select your certificate there <- that should be possible.

    If you cannot select the certificate than probably the certificate is in the wrong certificate store.
    If you can select the certificate, and the certificate is not valid [as NAV suggests] then possibly IIS will give a more detailed error message.
    If you can select the certificate and everything is fine on IIS, then check if the Service Account that is used by the NAV service has permissions on the certificate ( go to 'manage computer certificates', select your certificate, right click, click 'All Tasks', 'Manage Private Keys')
    Jan Veenendaal
  • Options
    martin78martin78 Member Posts: 5
    Hi Jan,

    Thank you for your answers.

    I have IIS on the same server, and have just tested.
    I can choose and use the trudsted SSL. I can also type in the external SSL name, and enter IIS' default site.
    ( No SSL warnings).

    The service user, NAV service is running with, have "full control".

    But can not start the NAV service.

    What about "certificate purposes" ?
    All purposes is enabled but this certificate only have "server authentication" and "client authentication".
    Can this be the reason?
    A self generated have a lot more purposes...

    Best regards
    Martin
  • Options
    Jan_VeenendaalJan_Veenendaal Member Posts: 206
    We are using a certificate, issued by COMODO, that has only the same two 'purposes' and that works fine.

    Do you get any error messages in the Windows Event Log ?
    Jan Veenendaal
  • Options
    martin78martin78 Member Posts: 5
    Strange.

    I have this in the application log:


    Message:
    The security certificate that has the provided 'ServicesCertificateThumbprint' is not valid.
    Description = '[Subject]
    CN=Navhost1.mydomain.com, OU=Domain Control Validated, C=DK

    [Issuer]
    CN=AlphaSSL CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Sign In or Register to comment.