3

IE has started exhibiting a strange behavior. We have several intranet nodes (routers) that are configured to use HTTPS for access, but which have untrusted / self signed certificates on them. At some unidentifiable point in the recent past, there was no problem connecting to these devices. That is no longer true. When you attempt to connect, and choose option 3 ("to connect to the site anyways") IE comes back immediately with a "Connection Unavailable" screen. This occurs in IE8 and now (ugh) ie9.

Firefox has no problem connecting to these locations, which indicates that its not a TCP stack problem. Google Chrome fails to connect; but then Google Chrome fails at a lot of stuff.

We have tried adding them as trusted sites. No difference.

Clearly there is some obscure setting or MS has come out with a patch that breaks things. Any ideas?

Improve this question
2
  • stackoverflow.com/questions/681695/…
    – NotMe
    Jan 17, 2012 at 21:31
  • This question is not really for stack overflow, as it focuses on programming problems. Perhaps Server Fault, where questions are focused on servers, networks, and professional desktop maintenance?
    – Lomky
    Jan 17, 2012 at 21:32

3 Answers 3

Reset to default
3

This problem is caused by a very recent ms update: kb2585542

There is a fixit associated with ms12-006 which allows you to turn off part of the update. Issues are described at http://support.microsoft.com/kb/2643584

Specifically Microsoft Fix it 50824 needs to be applied. You then need to update ie to only use ssl3 and tls1.2 and for our systems this fixed the problem

Improve this answer
1
  • Thanks for posting. If this is indeed the solution, could you please mark this as your answer?
    – John H
    Jan 19, 2012 at 17:14
0

Check the certificate section in your browsers. If there are certificates from these devices, delete them, clear your browser's cache and restart the browser.

My HP ILOs would do this sometimes with the self-signed certs. Once you accept the cert, it installs it but the next time you connect it gets all confused for some reason. At least FF and IE used to get confused.

Improve this answer
0

If you have more than just a few of these servers, it's probably worth having a little internal Certification Authority:

  • Create a small CA, in particular your own CA certificate + its private key.
  • Issue certificates using this CA for each of your internal servers (and set it up within that server).
  • Imported the CA certificate as a trusted certificate on your intranet machines.

This way, you won't have to handle exceptions every time you add a new server on your intranet. If you're new to this, it can be a bit of a hassle, but it's the clean way to do it.

There are tools to help you set up a CA. Depending on the size, something like Tiny CA might be sufficient. You may find other suggestions in the answers to this question: https://security.stackexchange.com/q/7030/2435

Make sure the host names in the certificates you issue are in a Subject Alternative Name DNS entry and (just in case) in the CN RDN of the Subject Distinguished Name.

Improve this answer

You must log in to answer this question.