Skip to main content
Khidzir_MN
Staff
Khidzir_MN
Staff
February 25, 2025

Troubleshooting Tip: Web application is inaccessible after the Windows Server IIS Centralized Certificate Store (CCS) is enabled for the Real Server

  • February 25, 2025
  • 0 replies
  • 366 views
Description This article describes how to fix the issue where the web application is inaccessible after the Windows Server IIS Centralized Certificate Store (CCS) is enabled for the Real Server.
Scope FortiWeb and FortiWeb-VM.
Solution

Windows Server IIS 8.0 and later provides an option to use a Centralized Certificate Store (CCS).
This feature provides an option to store and manage SSL certificates centrally instead of installing the respective server certificate on each of the respective web servers.
The feature uses the Server Name Indication (SNI) information from the client to match with the respective certificate.

 

By Default, FortiWeb does not forward the SNI information from the client to the respective Server Pool member.
This eventually breaks the communication as the Real Server (IIS) is unable to get the SNI information and hence unable to match the correct certificate.


Enable the 'Enable Server Name Indication (SNI) Forwarding' option in the respective Server Pool member so that FortiWeb will forward the SNI information. This option needs to be enabled for every Server Pool member:

 

enable_sni_forwarding.png

 

Related documents:
Central Certificate Store (CCS) with IIS

Defining your web servers
      Terms & ConditionsAccessibility statement