Using SSL to Encrypt Confidential Data

Applies To: Windows Server 2003, Windows Server 2003 with SP1

You can configure Secure Sockets Layer (SSL) security features on your Web server to encrypt network transmissions, which will help ensure the integrity of your data transmission, and to verify the identity of users. SSL can be configured to provide security for any portion of the Web sites or applications on the Web server.

You can configure SSL to help protect confidential data on a URL-by-URL basis (individual portions of the Web site or application). One portion of the application might require encryption of data transmissions with SSL (by specifying HTTPS in the URL), while another portion of the application might allow unencrypted data transmission (by specifying HTTP in the URL). This flexibility in security configuration allows you to provide encryption of confidential data as required, which is unlike IPsec and VPNs because they require that you encrypt all traffic between the clients and the Web server.

As an example, consider a fictitious organization called Contoso Pharmaceuticals that has an e-commerce Web site on the Internet. The Web site contains both secured and unsecured content. The URL for the unsecured home page is https://www.contoso.com. The URL for the secured e-commerce portion of the Web site is https://purchase.contoso.com. Traffic between clients and the home page is unencrypted; whereas SSL encrypts traffic between clients and the e-commerce portion of the Web site.

To use SSL, you must install a valid server certificate on the Web server for each Web site that you want to use with SSL. Certificates are usually granted to organizations through trusted certification authorities. Part of the information that is contained in a certificate is information about the organization to which the certificate was granted, such as the registered domain name. Thus, Web sites with registered domain names need their own certificate.

You can also host multiple SSL-enabled Web sites, each with a different server certificate, on one IP address. To set up this scenario, configure more than one IP address-port combination for the IP address and assign a different certificate to each combination. When an https:// request comes to the Web server, IIS looks up the IP address-port combination to determine which certificate to use.

Client browsers perform a number of verification checks on the SSL certificate. When a client browser detects an incorrect value in the certificate, the browser displays warning messages. The client browser can verify the following:

• Digital signature of the certificate

• Expiration date of the certificate

• Registered domain name to which the certificate was issued against the URL requested

To enable SSL, complete the following steps for each Web site and application:

1. Request a server certificate for the Web site from a certification authority.

   You can use the Web Server Certificate Wizard either to generate a certificate request file (Certreq.txt, by default) that you send to a certification authority, or to generate a request for an online certification authority, such as Microsoft Certificate Services in Windows Server 2003. Depending on the level of identification assurance offered by your server certificate, you can expect to wait several days to several months for the certification authority to approve your request and send you a certificate file.

   For more information about requesting a server certificate by using the Web Server Certificate Wizard, see Request a Server Certificate.

2. Install the server certificate to be used by the Web site on the Web server.

   For more information about installing the server certificate on the Web server by using the Certificate MMC snap-in, see Install a Server Certificate.

3. Assign the server certificate to the Web site.

   For more information about assigning the server certificate to the Web site, see Assign a Server Certificate to a Web Site.