Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So I received an email from my system administrator who wants me to secure a server I own that seems to have a vulnerability in port 443 (which is Windows RPC over HTTPS). Disabling it I know causes some problems with the UI of Windows so I don't want to mess with that. They are saying it is not SSL enabled so it is insecure.

They suggested that I establish an SSL certificate for the service. I don't know where to begin to do this and I couldn't find any articles on this subject.

Any ideas on what I can do here?

EDIT: Sorry it is a Win2003 R2 server. And I believe 443, is the IIS HTTPS service, I don't know how to fix it so the SSL works, apparently, previous users installed a certificate, and it expired--now I don't know what to do.

EDIT2: The previous administrators installed a certificate which promptly expired in 7 days, months ago. I don't believe my site needs certificate, because it is an IP address for a test-site, and I've never heard of anyone spending money to protect an IP address with SSL unless money/personal-info is involved. My question is, is it necessary? And my other question is, why would system administrators flag this as a "server vulnerability that needs to be fixed"--when it is simply a website-access vulnerability that has no relation to gaining server-machine access.

share|improve this question
1  
You would have to get an SSL certificate from a certification authority. Depending on the purpose of the cert, and where you get it, it could eventually cost some money :/ –  Thomas W. Jul 21 '11 at 18:34
1  
"Maybe I don't need any SSL protection for my website" Your users would dissagree if you have them pass any information they don't want others to read in clear text. Port 443 is SSL, bro. –  k to the z Jul 21 '11 at 18:45
1  
In that case, every website should be SSL shouldn't it? I think the importance and the context of what the website deals with (such as personal info / money / banking / credit cards) would dictate whether or not you should use SSL. As well as whether the website is a huge traffic site or just a small blog or testing site. Again I ask, how is it a vulnerability in the server security? –  Dexter Jul 21 '11 at 19:08
1  
@Dexter, welcome to the site! I think your question is not clear. Are you asking, how to install an SSL cert in IIS? If so, it should be clarified - but over on Server Fault, not here (that's an admin/howto question, not a security question). Or are you asking, should you put a cert on? We'd need more details regarding your site, the data, userbase, etc. If you're asking about details of the vulnerability, we'd need more information about what this RPC service (HTTPS from IIS is not RPC) is. –  AviD Jul 22 '11 at 12:21
1  
Hi @Dexter, as indicated this question needs tidying up before we can understand what problem you're trying to solve. As I read it, you have IIS running with port 443 open, but it has an invalid SSL certificate and you want to know how to deploy a certificate? Is that correct? –  user185 Jul 22 '11 at 13:36

3 Answers 3

up vote 4 down vote accepted

Yes, to set up your server with SSL, you'll need a digital certificate. If you're IT is just saying "set up SSL" and not giving you instructions for certificate generation, then it's likely that a self-signed certificate is all you need at the moment.

There should be a ton of articles on this - needing to set up a certificate and SSL on the server is a fairly common task. I'm not enough of a Windows 2003 geek to tell you what's good from bad, but this one at least looked reasonable:

http://www.xenocafe.com/tutorials/self_signed_cert_IIS/self_signed_cert_IIS-part1.php

I agree the MS stuff is painful to dig through on this!

In general, the things you'll need to do is: - create a key pair - generate a self-signed certificate

(usually these two can be done with a tool that is provided by the server or downloaded for free - like Open SSL)

  • configure the port with SSL/TLS, point it to the newly created key pair and certificate, and configure what it will accept from the client in terms of credentials. If IT isn't bugging you and this is within your network and therefore somewhat protected you may be able to leave these settings at a "accept all" sort of mode.

Microsoft is extremely... special (aka annoying) about all things PKI. They never quite implement the standards the way other companies do. As a result, if you can, stick with Microsoft-focused tools, it'll make your life a lot easier.

Also worth a check - ask your IT if you have a local Microsoft CA lying around. It may be easier to have your server register with the local domain and get itself a legitimately signed certificate. I believe IIS servers have configurations that let them do this automatically.

share|improve this answer
    
I mean the website is an IP address, that's basically used to show off the website to people to show examples of what they can do with it. I am not exactly seeing the benefit of messing around with SSL cert generation and trying to get it to work with IIS6 (let alone having to pay for the certificate). –  Dexter Jul 21 '11 at 19:06
1  
From your post, I wasn't clear that you were looking to be sold on the idea, so much as trying to figure out a way to get it done because you were being told to do it... I'll hardly make a case that it's easy or highly important to your application - but I will say that IT isn't so crazy for asking that you do something to secure an externally facing web server with known vulnerabilities - exploit of the server can lead to exploit of your entire network, so you're not just risking your own web server with this. –  bethlakshmi Jul 21 '11 at 19:15
2  
"Gaining access to accounts on the website is no threat to gaining access to the server itself or the network." Actually it is. Many attackers gain website access as a platform from which to launch further attacks. –  this.josh Jul 22 '11 at 0:13
2  
Actually, @Dexter, this is one very common method of gaining access to the OS: break or abuse the web server process to gain access to run as that account, then escalate to higher privilege account until you get to an admin/root type account. –  Rory Alsop Jul 22 '11 at 17:46
1  
Boys, play nice, or I'll take your toys away :). But seriously, @Dexter it seems that you have a series of questions there, that are no longer part of the original question. I suggest you ask them seperately, after you do a little bit more research, to focus your questions on what you want to know. In truth, there is a lot more to security than I think you suspect right now... Please do ask your questions, but try and focus them as much as possible. See also How to Ask. –  AviD Jul 25 '11 at 18:00

Go to the web address that points to that server. Should be https since it's 443. Your web browser should say hey this isn't secure in a big warning message when you visit the address. There should be a "View Certificate" option. See what company issued the certificate. Look that company up. Call them and say you want to renew it and they will walk you through what to do. Good luck.

::Edit::

Don't use a self signed certificate if this is an outward facing site. Everyone who visits it will get a scary message if you do.

share|improve this answer
    
It's accessible from the internet, but it's an IP address and only meant for a small userbase that tests the website, not really a real-use website. –  Dexter Jul 21 '11 at 19:06
    
Oh yeah? What's the IP? j/k –  k to the z Jul 21 '11 at 19:13
1  
Not having a domain name for a system that has an IP address is no protection from threats. Attackers commonly scan through blocks of IP addresses looking for a target. –  this.josh Jul 22 '11 at 0:15
    
If there already exists a cert, but it's expired, the SSL would still work, but the cert would not validate. In a browser, this would pop an error; don't know what it does in your given RPC client. In any event, @Dexter, that's not the same thing as "no SSL". –  AviD Jul 22 '11 at 12:18
    
Yes, there is a cert placed by previous devs that is expired. I don't see an error in my IIS website because I made sure SSL was NOT forced. I don't know anything about RPC or what it is or does. @thisjosh--yeah but how is a website-security issue related to a server-security issue? You can't exploit a website for not having SSL, you can only listen in for passwords for the website itself. –  Dexter Jul 22 '11 at 15:15

To answer your second question: The service does not get a lot more secure by adding a certificate. But it depends on how it is used.

  • With an outdated cert, a browser will always give warnings to the user, training them to click "ignore" in a dialog that they usually never should ignore.

  • A valid selfsigned cert you can acknowledge once and then use as usual. So the danger of MITM only exists at first connection. In contrast, an invalid cert will usually always produce an error and is not verified any further by the user, making it easy to mount MITM attacks.

  • If other machines are connecting to your service but not users, you can whitelist the fingerprint of the certificate in their configuration and will (likely) have the same level of security as with a properly created/signed certificate. Probably even higher because there are many CAs that could fail but only one cert with that same fingerprint. But you don't know how the validation is programmed, maybe the checks are not carried out correctly once the wrong date is noticed.

So you really should use a valid selfsigned certificate. Its very easy to do find tutorials for that and you can give it a validity period of one or two years.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.