Updating SSL Certificate for Lansweeper

Lansweeper has some great instructions for adding a SSL certificate to their IIS server.  I added a SSL certificate to the lansweeper server 11 months ago, and now it was time to update the certificate.  I logged into my digicert account and downloaded a pkcs 7 certificate to install into lansweeper.  I installed the cert to Certificates -> Personal -> Certificates.

and following Lansweeper's instructions also updating the iisexpressSvc.exe.config and restarting the service.  To my surprise I got the following error.

Being unable to bypass the error I discovered that putting the old certificate's thumbprint back into place or setting  "UseCustomSSLCertificate" to 0 you would be able to access lansweeper again.

<add key="UseCustomSSLCertificate" value="0"/>

<add key="CertificateThumbPrint" value="‎$TLSThumbprint"/>

The error logs were not really helpful either; showing just a binding error.

--------------------------------------Error Logs----------------------------------

me: 22-04-2021 12:06:50 - Result: ADD Custom URL -  Port: 443

Time: 22-04-2021 12:06:50 - Result: Error Performing Commands. System.ComponentModel.Win32Exception (0x80004005): A specified logon session does not exist. It may already have been terminated    at SslCertBinding.Net.HttpApi.ThrowWin32ExceptionIfError(UInt32 retVal)    at SslCertBinding.Net.CertificateBindingConfiguration.<>c__DisplayClass1_0.<Bind>b__0()    at SslCertBinding.Net.HttpApi.CallHttpApi(Action body)    at SslCertBinding.Net.CertificateBindingConfiguration.Bind(CertificateBinding binding)    at IISExpressSvc.ServiceStart.PerformCommands(String thumbPrint, Boolean isCustom, Boolean debug)

Time: 22-04-2021 12:07:04 - Result: === Stop ===

Time: 22-04-2021 12:07:29 - Result: === Start ===

Time: 22-04-2021 12:07:29 - Result: ADD Custom URL -  Port: 443

Time: 22-04-2021 12:07:29 - Result: Error Performing Commands. System.ComponentModel.Win32Exception (0x80004005): A specified logon session does not exist. It may already have been terminated    at SslCertBinding.Net.HttpApi.ThrowWin32ExceptionIfError(UInt32 retVal)    at SslCertBinding.Net.CertificateBindingConfiguration.<>c__DisplayClass1_0.<Bind>b__0()    at SslCertBinding.Net.HttpApi.CallHttpApi(Action body)    at SslCertBinding.Net.CertificateBindingConfiguration.Bind(CertificateBinding binding)    at IISExpressSvc.ServiceStart.PerformCommands(String thumbPrint, Boolean isCustom, Boolean debug)

Time: 22-04-2021 12:07:40 - Result: === Stop ===

Time: 22-04-2021 12:08:03 - Result: === Start ===

Time: 22-04-2021 12:08:03 - Result: ADD Custom URL -  Port: 443

Time: 22-04-2021 12:08:03 - Result: ADD Custom SSL -  Port: 443

Time: 22-04-2021 12:21:09 - Result: === Stop ===

Time: 22-04-2021 12:21:29 - Result: === Start ===

Time: 22-04-2021 12:21:29 - Result: ADD Custom URL -  Port: 443

Time: 22-04-2021 12:21:29 - Result: Error Performing Commands. System.ComponentModel.Win32Exception (0x80004005): A specified logon session does not exist. It may already have been terminated    at SslCertBinding.Net.HttpApi.ThrowWin32ExceptionIfError(UInt32 retVal)    at SslCertBinding.Net.CertificateBindingConfiguration.<>c__DisplayClass1_0.<Bind>b__0()    at SslCertBinding.Net.HttpApi.CallHttpApi(Action body)    at SslCertBinding.Net.CertificateBindingConfiguration.Bind(CertificateBinding binding)    at IISExpressSvc.ServiceStart.PerformCommands(String thumbPrint, Boolean isCustom, Boolean debug)

Time: 22-04-2021 12:21:53 - Result: === Stop ===

Doing some checks on Lansweeper's website I came across the same error on the forums. PR_CONNECT_RESET_ERROR when trying to connect via HTTPS - Followed the instructions. Why is my result bad?

After trying the notepad instructions, and it failing spectacularly, I researched the error "A specified logon session does not exist.  It may already have been terminated."

On techraptor.net I found this post https://techraptor.net/guides/how-to-fix-iis-server-error-specified-logon-session-does-not-exist stating that the certificate had to be reimported, following this procedure:

Run MMC

Here’s how to fix:

Open up certificates in MMC

Step 1: Open up a Run window and type “mmc”

Step 2: Click File > Add/Remove Snap In

Step 3: Add > Certificates, Click OK

Step 4: Choose “Computer Account”, then “Local Computer” and proceed.

Step 5: Hit OK

Export Certificate in MMC

Step 1: Open “Certificates”

Step 2: Open the folder where your certificate is stored.

Step 3: Right Click on Certificate, All Tasks, Export

Step 4: Export to the server Desktop

Now you should be able to re-import your certificate into IIS (or just into MMC) without issue. Restart IIS, and Note: You may have to reimport as “Complete certificate renewal” depending on your certificate.  This did not fix the certificate issue.

What did fix the SSL Issue in lansweeper was the following this article on Microsoft.com to repair the certificate and added the private key.  https://docs.microsoft.com/en-us/troubleshoot/iis/assign-certificate-private-key

Below is the output from powershell, showing the successful repair of the certificate, and after running the commnad Lansweeper was able to run under the new certificate.

Windows PowerShell

Copyright (C) 2014 Microsoft Corporation. All rights reserved.

PS C:\Users\Administrator> certutil -repairstore my "Certificate Serial Number"

my "Personal"

================ Certificate 9 ================

Serial Number: 0933dade655d53658470d076c90446ff

Issuer: CN=GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1, O=DigiCert Inc, C=US

 NotBefore: 2021-03-22 6:00 PM

 NotAfter: 2022-04-23 5:59 PM

Subject: CN=*.sapl.ca

Non-root Certificate

Cert Hash(sha1): 01 e5 53 e4 cc cf f9 73 15 11 35 2e 0b fd c4 d1 91 74 b5 05

  Key Container = {63B4CC61-46F3-4C4B-9F8E-CB38E333DD79}

  Unique container name: 3f90b86fe9b728070aead75c51dfc869_ebcb9c16-cc6e-4b9c-b957-49c2f2cdfce1

  Provider = Microsoft Enhanced Cryptographic Provider v1.0

Encryption test passed

CertUtil: -repairstore command completed successfully.

PS C:\Users\Administrator> 01 e5 53 e4 cc cf f9 73 15 11 35 2e 0b fd c4 d1 91 74 b5 05

After running the repair command in powershell as an administrator, lansweeper started working with the new certificate after updating the thumbprint and restarting IIS.

Adding Let's Encrypt TLS Certificate to SirsiDynix Horizon Web Serivces Tomcat Server

Following up on my post on How to setup Horizon Web Services I am now going to go over how to secure your connection as much as possible using a Let's Encrypt TLS/SSL Certificate.  Horizon Web Services is an application created by SirsiDynix that uses apache tomcat that allows access to a library ILS via API along with some other things (bookmine, bluecloud connection, etc).

Horizon Web Services can be run on the following Operating Systems in both 32 and 64 bit:

• Microsoft Windows Server 2008 r2 or 2012 r2
• Linux (Red Hat Enterprise 6 or 7; SUSE Enterprise 10 or 11)
• Sun Solaris 10 or 11 (both Intel and Sparc)

This post will be how to secure Horizon Web Services on Windows Server 2012, almost everything will be done by Administrative CMD Prompt.  Sirsidynix recommends working out of your Web Services Directory and this is the order we are going to go though to setup our TLS/SSL certificate.

1. Setup an environmental variable for the pathing to the Java bin directory
2. Create a Certificate Signing Request
3. Get an SSL Certificate from ZeroSSL.com
4. Add the Certificate verification to your DNS
5. Schedule a task every 3 months to update the TLS certificate or find a way to automate it.

Setting up the Environmental Variable in Windows

Everything we need to setup/add the TLS/SSL certificate in apache tomcat is in the Java Directory.  Right click on the computer and get the properties -> Go to the Advanced Tab -> press on the Environment Variables button.

System Properties Dialog Box

Setting Environment Variables

When you go to run the Tomcat TLS/SSL commands you will need to put "$JAVAVAR" in quotes in your command prompt so windows know where to run the commands we are going to run.

Create a CSR (Certificate Signing Request)

Tomcat uses a java keystore for storing all the certificate information.  There are a couple of things you will want to think about and document ahead of time before you start setting up your CSR.  

1. One is the Alias for the keystore
2. Is the name of your keystore file
3. The password for your keystore file

The keystore alias and file name can be literally anything.  See the example below

"$JAVAVAR"\keytool -genkey -alias webservices -keyalg RSA -sigalg SHA256withRSA -keystore supersecrets -keysize 2048

The break down of the above statement is the keystore data is in an "container" called webservices.  This "container/alias" is in a file called supersecrets which is in the webservices directory.  This is protected by a password which you specify when you create the keystore file.  By default the tomcat keystore password is changeme.

NOTE:

the keystore has a .keystore extension associated with it though I found you don't need to put the .keystore behind the keystore file name, but if you want to use something like Portecle to view, edit and maintain your keystore you will need to change your open view to all files.

Make sure your in your Web Services Directory (Typically D:\SirsiDynix\WebServices)

Command to create the keytool for the TLS/SSL Certificate

After you run the command you will see something like this in your WebServices Directory

Files in the WebServices Directory

With your CSR file now created we can go to zerossl.com and start creating our TLS/SSL Certificate

Select the Free SSL Certificate Wizard

I didn't have an IP setup where I could use port 443 to verify the TLS certificate so I used DNS verification.  Paste your CSR in the right hand field and leave the left box blank so it auto generates your Let's Encrypt Key.

When verifying your TLS/SSL Certificate using DNS verification you will need to make an A record and setup a txt record with something like the following.

ACME-CHALLENGE for DNS TXT RECORD

Once you have been verified you will be taken to the confirmation page.

Your Certificate is Ready

Here you download the certs and then you can added it to the keystore.  Your domain and intermediate certs are in the domain-crt.txt file with the domain cert being the first part and the intermediate certs are the second part

Files from zerossl.com

The domain-crt opened in a text editor

Import the Intermediate Cert

Import Domain Cert

Now you need to open the server.xml file typically located in webservices -> conf folder; and edit the keystoreFile, keystorePass, and server.  Once this is done save the file and either reboot or restart the Tomcat Server. 


If you want to have a full look at your keystore you can use Portecle and can dig deep and make changes to the certificates

Portecle GUI

Auto-Renew the Certificate

When I figure out a good way to automate the updating of the TLS Certificate I will definitely update this post in the meantime the best thing I can come up with are a calendar alert and to schedule it into the maintenance cycle, which isn't the worst thing in the world it makes you have a look at the server and make sure it is working and up to date.  You can download the auto-renew portable app for renewing here https://github.com/do-know/Crypt-LE/releases

Update!  Horizon Web Services Released April 3rd!
https://support.sirsidynix.com/alert/81823