You can diagnose IIS certificate errors that prevent a MDrivenServer or MDriven Turnkey site from starting or communicating with itself; this page is for administrators hosting MDriven applications on IIS.

MDrivenServer makes internal calls to itself. The HTTPS URL used by the application and the name covered by the certificate must match. A browser warning that you choose to bypass does not fix this requirement: MDrivenServer must be able to accept its own certificate.

The required match

Check these three items together:

Item	What must match	Example
URL used to open the site	The host name in the HTTPS address	https://RAPTOR3NY/MyTurnkeyApp/__MDrivenServer/
Certificate identity	The certificate's Issued to value (the certificate name/CN)	CN=RAPTOR3NY
IIS HTTPS binding	The certificate selected for the site on port 443	The binding uses the certificate issued to RAPTOR3NY

In this example, use RAPTOR3NY in the URL. Opening the same site as https://localhost/... does not match a certificate issued to RAPTOR3NY and causes a certificate error.

Diagnose a certificate error

1. Open IIS Manager.
2. Select the IIS server node, then open Server Certificates.
3. Locate the certificate intended for the site and open it to view its information.
4. Record the name shown in the certificate's Issued to field. For a self-signed certificate created for a machine, this is typically the server machine name.
5. Select the web site in IIS and open its bindings. Confirm that its HTTPS binding uses port 443 and that the selected certificate is the certificate you inspected.
6. In the browser, open the MDrivenServer URL using the certificate's name, not an alternative name such as localhost.
7. If Turnkey is installed below the application, also test its URL using that same host name. For example, if the application is MyTurnkeyApp, test https://RAPTOR3NY/MyTurnkeyApp/ and https://RAPTOR3NY/MyTurnkeyApp/__MDrivenServer/.

If the certificate name, IIS binding, and URL do not agree, correct the binding or use a certificate valid for the URL that the application uses. Do not treat a browser bypass as a solution; internal MDrivenServer communication still requires a certificate that it can accept.

Create and use a self-signed certificate for development

A self-signed certificate is suitable for development. When you create it in IIS, create it using the server machine name, then use that name when accessing the site.

1. In IIS Manager, select the IIS server node and open Server Certificates.
2. Create a self-signed certificate using the server's machine name.
3. Select the target web site and add or edit its HTTPS binding on port 443.
4. Select the self-signed certificate for that binding.
5. Open the application with an HTTPS URL whose host name is the certificate's Issued to name.

For example, if the certificate information shows CN=RAPTOR3NY, access the application through https://RAPTOR3NY/..., not https://localhost/....

For local development, Certificate documents the Chrome setting chrome://flags/#allow-insecure-localhost. This setting concerns localhost; it does not change the requirement that MDrivenServer must accept the certificate used for its internal HTTPS calls.

Common symptoms and corrective action

Symptom	Likely cause	What to check
The browser reports that the certificate does not match the site	The URL host name differs from the certificate's Issued to name	Reopen the site with the certificate name, or use a certificate valid for the intended URL.
The site works only after accepting a browser warning, but MDrivenServer or Turnkey still fails	The browser exception does not make the certificate acceptable to MDrivenServer	Use a certificate that is valid and accepted for the URL used by the server itself.
https://localhost/... fails after creating a certificate for the machine	The certificate was issued to the machine name rather than localhost	Use the machine name shown in Issued to.
HTTPS is configured but the wrong certificate is served	The IIS site binding selects a different certificate	Verify the certificate selected on the site's port 443 HTTPS binding.
A newly installed on-premise Turnkey site cannot perform internal communication	HTTPS and certificate setup was skipped or the address does not match the certificate	Verify the HTTPS binding and use the certificate name for both the Turnkey and __MDrivenServer URLs.

Scope and related configuration

This page covers the name and trust problem that affects certificate validation. For certificate management, including code-signing and SSL certificates, see Documentation:Certificate. For the IIS installation sequence and HTTPS binding context, see HowTos:Installing MDriven Server on Windows or Documentation:Set up MDriven Turnkey on premise.

A certificate problem is separate from IIS application recycling. If IIS or an Azure Web App repeatedly restarts, see Documentation:IIS application restart problem. For TLS configuration guidance, see Documentation:SSL/TLS settings.

See also

• Documentation:Certificate
• HowTos:Installing MDriven Server on Windows
• Documentation:Set up MDriven Turnkey on premise
• Documentation:SSL/TLS settings
• Documentation:IIS application restart problem