Optional SSL Configuration

the metrics server is not compatible with ssl if your system has windows authentication set up you can configure for ssl this configuration is optional there are three scenarios the application database and the configuration database both use ssl see configuring ssl for the configuration and application databases docid\ aei5nbqfmqwo5t3rabtex the application database uses ssl but the configuration database does not use ssl see configuring ssl for the application database only docid\ aei5nbqfmqwo5t3rabtex neither the application database nor the configuration database uses ssl in this scenario, do not check ssl on any of the pages of the system configuration wizard for all fields in the system configuration wizard that ask for a server location, when using ssl, you must enter a fully qualified domain name (fqdn) this is because ssl needs a certificate and the certificate authority requires an fqdn configuring ssl for the configuration and application databases to configure both your application database and the configuration database to use ssl, follow all of the steps in all of these sections before you begin docid\ aei5nbqfmqwo5t3rabtexconfiguring ssl in microsoft iis manager docid\ aei5nbqfmqwo5t3rabtexconfiguring ssl in the system configuration wizard docid\ aei5nbqfmqwo5t3rabtex before you begin ensure that https \\\localhost 443 displays the microsoft iis manager welcome page ensure that your system has a valid certificate configuring ssl in microsoft iis manager in microsoft iis manager, navigate to sites > default web site and select ssl settings on the ssl settings page, check require ssl and under client certificates, select ignore navigate to sites > heat and select ssl settings on the ssl settings page, check require ssl and under client certificates, select ignore navigate to sites > centralconfig and select ssl settings on the ssl settings page, check require ssl and under client certificates, select ignore navigate to sites > frssurveyproxy and select ssl settings on the ssl settings page, check require ssl and under client certificates, select ignore add an ssl port by doing the following a navigate to sites > default web site , right click, and select edit bindings b click add c in the add site binding dialog box, for the type field, select https and in the ssl certificate field, select the certificate that you received from the certificate authority the system automatically enters 443 for the port d in the ip address field, enter a fully qualified domain name e click ok verify that you can access https // fully qualified domain name configuring ssl in the system configuration wizard in the system configuration wizard, on the configuration application page, ensure that the value in the configuration server domain name field uses a fully qualified domain name do not use a machine name configuration application page on the bottom of the application page, ensure that you check use domain name to access application and enter a fully qualified domain name for the application server do not use a machine name application page on the application server settings page, do the following ensure that you enter the fully qualified domain name in the configuration server location field check use ssl enter the fully qualified domain name in the host name field application server settings page on the other feature settings page, for the application server, check use ssl other feature settings page on the metrics server page, check use ssl metrics server page configuring ssl for the application database only to configure your application database to use ssl but not the configuration database, follow all of the steps in all three sections before you begin docid\ aei5nbqfmqwo5t3rabtexconfiguring ssl in microsoft iis manager docid\ aei5nbqfmqwo5t3rabtexconfiguring ssl in the system configuration wizard docid\ aei5nbqfmqwo5t3rabtex before you begin ensure that https \\\localhost 443 displays the microsoft iis manager welcome page ensure that your system has a valid certificate configuring ssl in microsoft iis manager in microsoft iis manager, navigate to sites > default web site and select ssl settings on the ssl settings page, ensure that require ssl is not checked under client certificates, select ignore navigate to sites > heat and select ssl settings on the ssl settings page, check require ssl and under client certificates, select ignore navigate to sites > centralconfig and select ssl settings on the ssl settings page, ensure that require ssl is not checked under client certificates, select ignore navigate to sites > frssurveyproxy and select ssl settings on the ssl settings page, check require ssl and under client certificates, select ignore add an ssl port by doing the following a navigate to sites > default web site , right click, and select edit bindings b click add c in the add site binding dialog box, for the type field, select https and in the ssl certificate field, select the certificate that you received from the certificate authority the system automatically enters 443 for the port d in the ssl certificate field, enter a fully qualified domain name e click ok double click configuration editor the configuration editor dialog box opens select system webserver and then select serverruntime modify the uploadreadaheadsize value to 2147483647 click apply verify if you can access https // local host configuring ssl in the system configuration wizard in the system configuration wizard, on the application page, ensure that the application database uses a fully qualified domain name and not a machine name application page on the application server settings page, do the following ensure that use ssl is not checked ensure that you enter the fully qualified domain name in the configuration server location field ensure that you enter the host name, and not the fully qualified domain name, in the host name field application server settings page on the other feature settings page, check use ssl this is the only place in the system configuration wizard where you check use ssl do not check use ssl on any other page other feature settings page configuring ssl for integration service ivanti integration service by default configured to work on non ssl port irrespective of the “ssl” check box is selected in system config wizard (scw) \<that scw checkbox tells other parts of the product that the integration service is ssl (or not), so it needs to be checked, and the manual edit of the json file is also needed > to make integration service work on ssl port, following steps to be performed on each server where ivanti integration service is running stop the ivanti integration service add the following entries at the end of appsettings json of integration service the default path for integration service is “c \program files\heat software\heat\integrationserver\appsettings json” "kestrel" { "endpoints" { "httpsinlinecertfile" { "url" "https //\<integrationurl> 1213", "certificate" { "subject" "\<systemcertificate>", "location" "localmachine", "allowinvalid" true } } } } the integrationurl should be replaced with the actual integration url configured in scw and a trusted certificate is available in your local computer > personal certificate store \<ensure the value in the appsettingss json file is the "issued to" string > ivanti recommends that there is only one if there is more than one cert here with the same name, the os will choose one so it is best practice to ensure only one cert is present with the same name as configured in the json file systemcertificate should be replaced with the installed certificate name on server machine where the integration service is running start the integration service verify that https //\<integrationurl> 1213 /integrationservice svc is the correct url open the web config of heat application located in “c \program files\heat software\heat\appserver” and update the integrationurl with right value for the following binding \<endpoint address="https //< integrationurl > 1213 /integrationservice svc" binding="wshttpbinding" bindingconfiguration="wslargedatabinding" contract="integrationservice iintegrationservice" name="integrationserviceendpoint"> open the appsettings json of heat application located in “c \program files\heat software\heat\appserver” and update the integrationurl with the right value for the following binding "integrationserviceuri" https //< integrationurl > 1213 reset the iis