7

I'm using SXA and have found that while using the Maps and Location Finder component that the utodetect location feature is no longer available for insecure origins.

You may see an error such as this in the DevTools console.

API feature unavailable

What are some possible approaches to both configuring the HTTPS setup locally, but also for a team of developers?

Also noticing that the Chrome browser complains about it too next to the omnibox.

Not Secure message

9

This is not a solution I recommend for a production server, but if you need a certificate for a development server, I have a solution for you.

I use use a PowerShell script to create a certificate, and then configure my IIS site to use the certificate.

Here is the script I use. Before running the script you must set the variable $dnsname to the name of your site.

$dnsname = "aaa"
$pwd = ConvertTo-SecureString -String "123456" -Force -AsPlainText
$print = (New-SelfSignedCertificate -certstorelocation cert:\localmachine\my -dnsname $dnsname).Thumbprint
$path = "c:\Windows\temp\cert.pfx"
Export-PfxCertificate -cert cert:\localMachine\my\$print -FilePath $path -Password $pwd
$file = ( Get-ChildItem -Path $path )
$file | Import-PfxCertificate -CertStoreLocation cert:\LocalMachine\Root -Password $pwd
Remove-Item $path

After you run the script, you can assign the certificate to your site:

  1. Open IIS Manager
  2. Select your site
  3. Edit bindings for the site
  4. Add a new binding.
  5. For type, set https.
  6. For hostname, set the value of the $dnsname variable from the PowerShell script.
  7. From the SSL certificate dropdown, select the certificate with the name that matches the hostname.
  8. Click OK to save your changes.

Now you can access your server using your preferred host name without getting any browser errors.

Note: Lest anyone mistake me for a PowerShell guru, I found this script on the internet long ago. I've been using it for years. At this point, I can't remember where I originally got, so unfortunately I cannot give proper credit.

5

You can install a self signed cert as described in other answers here but also there is a new free SSL cert provider called Lets Encrypt: https://letsencrypt.org/. I believe you can install ssl certs from here wherever you like.

Rick Strahl has a great post on how to do this easily on Windows using letsencrypt-win-simple in his blow post here: https://weblog.west-wind.com/posts/2016/feb/22/using-lets-encrypt-with-iis-on-windows

In terms of enabling/disabling SSL we handle enforcing HTTPs like so with an IIS rewrite rule and put this in our production and staging configs etc. You could enable this in development environments too if you need to:

<rule name="HTTP to HTTPS" stopProcessing="true" xdt:Transform="InsertBefore(/configuration/system.webServer/rewrite/rules/*[1])">
        <match url=".*" />
        <conditions>
            <add input="{HTTPS}" pattern="off" ignoreCase="true" />
        </conditions>
        <action type="Redirect" redirectType="Permanent" url="https://{HTTP_HOST}/{R:0}" />
</rule>
  • I didn't read the entire blog post, but doesn't Let's Encrypt need an open port to your computer (letsencrypt.org/how-it-works), which might be so handy in case of local developer machines? – Thomas D Oct 13 '16 at 8:54
  • Let;s encrypt needs an open port and an accessible url to vaildate certificates, otherwise it does not hand out free certificates, so this answer does not provide the correct solution. The rewrite rule, however, does the right thing. In addition to this, I would recommend to add the HSTS header as well – Bas Lijten Oct 13 '16 at 9:08
2

You may create your own Self Signed Certificate from IIS as shown below:

enter image description here

Once it is generated, you need to add the https domain binding to your site as below:

enter image description here

You just need to select the newly created SSL certificate from the select box. Once this is setup, you need to make sure that the URL being generated is set to HTTPS.

2

As an addition to the use of certificates, there's a few infrastructure settings that makes the system easier to manage.

  1. I recommend adding a boolean config setting that will enable/disable the ssl depending on the environment. It helps to test with SSL but it's not always required to go through the SSL setup just to build a feature or configure an additional environment.
  2. I would add an attribute to each site node to specify if that site uses SSL. Not all sites may be covered during a license lapse or if they're newly migrated.
  • Are there any modules available that provide these capabilities? – Michael West Oct 12 '16 at 21:06
  • Mark, do you have any example configs that demonstrate that? – Pete Navarra Oct 12 '16 at 21:06
  • @PeteNavarra There's no modules for it but I added a sitecore <setting name="enable.ssl" value="true" /> this value would be switched based on the environment you're working in so you don't have to setup a certificate for every environment. The other setting is to add an attribute on your site nodes like so: <site name="website" usessl="true" ... /> which would depend on the site that has a certificate. I was just using these to force a redirect to https if both are true and when building the sitemap.xml files so google propagates the use of https for links to those sites – mark stiles Jul 19 '17 at 18:23
  • @MichaelWest See above – mark stiles Jul 19 '17 at 18:23
1

A best practice here would be install a local Certificate Authority (CA). If your network has a Windows Domain Controller, I would highly recommend Active Directory Certificate Services.

Using such solution will allow you to keep things more organized and automatic, as you won't need to generate a certificate and share across the dev environment as domain-joined machines will automatically trust the certificates.

Benefits

"Applications supported by AD CS include [...] Secure Socket Layer/Transport Layer Security (SSL/TLS)"

  • Certificate enrollment that uses HTTPS protocol

  • Certificate enrollment across Active Directory Domain Services (AD DS) forest boundaries

  • Improved support for high-volume certificate issuance

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.