How do I prevent un-encrypted report manager connections?

Question

Hi, I am installing SSRS 2008 currently and am trying to ensure that all reports are delivered encrypted, via the certificate we have on the server. I have the default config for SSRS after installation and have added the certificate to Report Server and Report Manager. I can now access https://server/reportserver_instance and https://server/reports_instance and the certificate is acknowledged by the browser.

However, I can still access http://server/reportserver_instance and http://server/reports_instance and get unencrypted content. When I removed the port 80 connection via the advanced tab the report server ceases to provide any content and I get "The underlying connection was closed: An unexpected error occurred on a send."

Any thoughts, suggestions, solutions welcomed!

Answer 1

Start -> Run -> inetmgr. Navigate to the report server site and check the value of the Enabled Protocols. If it is set to http (or https) then both protocols are enabled. This is a problem because the site is listening on both ports (80 and 443) and serves http requests which is not what you want. The details of the Enabled Protocols settings have this in the details frame:

if you want to accept only HTTPS requests, configure SSL feature for your site.

I believe that this means double-clicking on SSL Settings and then making sure that Require SSL checkbox is checked. What this should accomplish is the following: when the client sends a plain vanilla http request to the report server site, the latter will bark, stating that no http connections are allowed and https should be specified as a protocol. From what I understand, you have already configured secure bindings before, so your report server site does accept https connections.

Hope this helps, I can see how availability of http can be really annoying if the site in question is meant to work over secure socket layers only.

Oleg

Answer 2

0

I think you need to set SecureConnectionLevel to 3:

0 = No SSL
1 = Accept HTTP but reject any calls that might be involved in the passing of credentials
2 = Use SSL for rendering but don't insist on it for all SOAP calls
3 = Use SSL for everything

answered Aug 05 '10 at 05:37 AM

David Wimbush
4.2k ● 25 ● 29 ● 31

yep, that looked like a winner for a while but every value except 0 returns the same error as removing the port 80 connection setting.

Aug 05 '10 at 06:21 AM Fatherjack ♦♦

(comments are locked)

Answer 3

0

Have you tried change the changing the "SecureConnectionLevel" to equal 0 with the rsReportServer.config file.

More info here

Link

answered Aug 05 '10 at 04:18 AM

sp_lock
8.1k ● 20 ● 26 ● 29

nice find. Sadly it hasnt resolved the issue as it is at 0 already. setting it to 1 gets me the same error as removing the port80 settings.

Aug 05 '10 at 04:29 AM Fatherjack ♦♦

(comments are locked)

How do I prevent un-encrypted report manager connections?

Follow this question

Related Questions