Moved to chinthanajayawardena.wordpress.com

Sorry for the trouble. I have moved my blog to chinthanajayawardena.wordpress.com

Solution for a common error "An error was encountered. Please return to the previous page and try again"

After some time I am back in web site coding. I think out of sight is out of mind is correct. Because I got into a very familiar error message, but forgot what I did back then. Anyway after some struggle I got over with it.

Above error message is a common error that throws when you try to access the Web Site Administration Tool. The reason behind is in the physical folder structure for your web application or web site is containing spaces in at least one of the folder names.

This error message is a very high level error message, so there may be other scenarios that it throws the same error message. I have no clue more than this.

My advice is to always keep your solutions path without spaces, you may use "_" or Camel-Case for folder naming.

I wish this information will be useful to someone.

How To Setup SSL in Azure Web Role

After a long time of interest of becoming a blogger here goes my first blog.
This is a problem I struggled for some days and I feel it's worthwhile to share that knowledge among others. 


Can't untie all knots at once, Lets go step by step.


First I would like to provide steps how you can setup SSL for a web site manually. There is no major difference in how you should setup SSL in Azure or in a normal web server. Except for the Azure deployment package needs to have instructions on how the SSL should be setup automatically (like a installation script). Because sometimes Azure servers get restarted due to maintenance requirements (such as OS upgrades), if you don't have the correct instructions, then it will reset the manually configured settings in the server.

What is the first requirement to make a SSL web site?

You need to have a certificate issued by an authorized SSL provider to your domain name.
If you plan to have sub domain names then you should obtain a wild card SSL certificate.


How can you obtain a SSL certificate? 

Create Certificate Request

1. Open IIS and select the Web Server node
2. On the right side panel under IIS category you will find an icon with the name "Server Certificates". Go to that feature.
3. You will see if you have certificates in that section.
4. Under the "Actions" panel, click on "Create Certificate Request" 
5. Complete the fields, make sure your domain name is correctly filled in "Common Name" field.
6. On "Next", you need to provide Cryptographic Service Provider Properties.
7. Now the minimum requirement of the bit length has increased by most of SSL providers to 2048.
8. No need to change the provider, but pick 2048 bit-length.
9. On "Next", you can provide the file path, where the certificate request will be saved.
10. Then press "Finish"
11. The generated file must be send to the SSL provider.

Complete the Certificate Request

1. The SSL provider will send you the certificate file once your organization is verified. Sometimes they send only the certificate string so you may have to copy and paste it into notepad and save it as a .cer file.
2. You will have to go to IIS again. 
3. Go to Server Certificates Feature -> Complete Certificate Request
4. In that popup, browse and pick the file you just saved as .cer file.
5. Give a friendly name to the certificate that will distinguish this certificate from other certificates installed in the server.
6. Press Ok.

(You can find these steps in most of SSL providers' web sites.)


Now you have the SSL certificate for your domain name and its been installed in the server. What's left is to configure a HTTPS binding to your web site.That you can do in following steps,

1. Select your web site node in the IIS
2. Click on "Bindings" link under "Actions" panel
3. Press "Add" button in the popup
4. Pick the type as HTTPS
5. Assign an IP Address
6. Leave the port as 443
7. Pick the certificate you just installed. It should be with your friendly name.
8. Press "OK"
9. If you want your site to work only under HTTPS, check "Require SSL" in the "SSL Settings" Feature under the web site node.

Ok!!! Then are we done with manual instructions for setting up SSL? That's a big NO. The whole process of making your site to run under SSL is to give safeness for the users. If we try to validate the SSL for your domain name it will indicate that you are missing some intermediate certificates. So, what are we missing? These are the certificates which verifies your SSL provider. Sometimes you may find these SSL providers' certificates are installed by default in your server. But I am referring to the scenario which does not have :-/.


You will have to go to the SSL providers web site to get these certificates. And installation instructions will be in their web site. Mostly those certificates are installed under the Local Computer ->Intermediate Certification Authorities
You can check certificate installation using certmgr tool. Or just typing "mmc" in Run command tool and adding the Certificates snap-in.
Remember there is another thing that you need to be aware of. That is these certificates can be revoked by the owner. If the SSL provider had certain certificates earlier that were been revoked lately, and now they have reissued those certificates. You will have to disable/remove all those old certificates from your certificate store.
Now I believe that you have successfully completed with setting up SSL manually.

Setup SSL in Azure package

Let's see what you have to do in Azure, to have those instructions to be automatically configured.
You can find some information on "How to configure an SSL certificate on an HTTPs endpoint" in here "http://msdn.microsoft.com/en-us/library/windowsazure/ff795779.aspx"
Usually the certificate issued for your domain name is installed in the Local Machine-> Personal folder in the Certificate Store.

To setup the Domain certificate for the Web Role.

1. Open the WebRole settings page.
2. Go to the Certificates tab.
3. Press "Add Certificate" button
4. In the new line just got added look for the Thumbprint column.
5. By pressing the "..." button you will get a popup listing certificates installed in the Certificate Store for Local Machine in the Personal Folder.
6. If the domain certificate does not exist in the list you will have to install or import it to that location. If not you will have to get the thumbprint from the certificate details tab and paste it here. (to get the thumbprint you can double click the cer file and go to the Details tab, it will list the thumbprint field)
7. You will have to install your SSL providers' certificates in your development environment under the Local Machine->Personal folder in the Certificate Store.
8. Once all your certificates are installed in the Personal folder, you can get them in the popup.
9. First certificate would be the domain certificate, select it from the popup.
10. The thumbprint automatically gets populated
11. "Store Location" shall be "Local Machine"
12. "Store Name" shall be "My"
13. Give a proper name as you like

To Setup the SSL Providers' Certificates

1. Repeat from step 3 to 5 of the above steps
2. Select the certificate
3. "Store Location" shall be "Local Machine"
4. "Store Name" shall be "CA"
5. Give a name for the certificate
6. You may repeat the above steps if the provider have more certificates.

Now your web role is ready to install all certificates. But your certificate provider may have certificates that needs to be disabled/removed. 

CertUtil tool

How to use that? Use certutil command as follows in a Startup command file.  


certutil -v -delstore authroot <Serial key of the certificate>


authroot - means the non-microsoft Root CAs.
Refer to this link given below for better understanding on certificate store folder names. You can check with the SSL Provider to figure out the folder name.
http://technet.microsoft.com/en-us/library/cc783813(v=ws.10).aspx


Now your package is ready for deployment. But if you try to deploy you will get an error stating that the certificates in the package are not available in azure. You will have to upload all the certificates into the Azure hosted service. In order to do that, you need to have the .PFX file of the certificate, and not the .CER file.You can always create the PFX file of the domain certificate using IIS where your domain certificate is created. Follow the steps given below,

1. Go to IIS -> Server Certificates
2. Select the domain certificate and click "Export"
3. You will have to give a location for the file to be saved and a password for the file. Then press "OK"

How to create PFX files for the SSL Provider's certificates.

There is a way to do that. But by using PowerShell ISE, the tool may reside in C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe (Similar to command prompt tool.)
This information is taken from here. You can refer to semicolonsandcurlybraces link for more information. Special thanks to them, it motivated me to do this blog.


Execute the following code to generate the PFX file, you may change the password as you wish.


$c = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\SSL_CA.cer")
$bytes = $c.Export("Pfx","Password")
[System.IO.File]::WriteAllBytes("C:\SSL_CA.pfx", $bytes)



Now you have PFX files for your certificates. Upload them to the Hosted Service you plan to deploy the package.




Few more points for your information,
If you are familiar with Azure, you may be aware of how the URL are being generated. All of them are sub domain of cloudapp.net. You will have to have a CName record pointing to the Azure production URL (Or else with IP address - an A record) with your domain name provider. So it may take a while to propagate IP address changes. If you are trying to verify the SSL Certificate installation is correct, there are tools available from Verisign, digicert and there may be more if you can search for it. 


Thanks for reading. I believe this will help someone.