Securing the Web Server using Secure Socket Layer (optional)

Your district has the option of securing the Web Server using the Secure Socket Layer (SSL) features in Internet Information Services (IIS). To do this, you need a certificate for each web site, that is, for each unique fully-qualified domain name.

Note: If your system is to employ a hardware SSL acceleration device, refer to the documentation that came with the device.

To create a certificate request:

On the Web Server, from the Start menu, click Control Panel > Administrative Tools > Internet Information Services (IIS) Manager.

In the Internet Information Services dialog, expand the folders.

Right-click Default Web Site and, from the menu, select Properties.

In the Default Web Site Properties dialog, click the Directory Security tab. Click Server Certificate.

On the Web Server Certificate Wizard, on the Welcome page, review the information detailing the status of your Web Server. Click Next.

In the Server Certificate dialog, select Create a New Certificate. Click Next.

In the Delayed or Immediate Request dialog, select Prepare the request now, but send it later. Click Next.

In the Name and Security Settings dialog, enter a name for the certificate and specify 1024 bit lengths. Click Next.

On the Organization Information page, in the Organization field, enter the name of the district requesting the certificate. In the Organizational Unit field, enter the name of the department requesting the certificate, such as "Security". Click Next.

On the Your Site’s Common Name page, in the Common Name field, the wizard populates the name of the Web Server that the certificate will be issued for. Click Next.

On the Geographical Information page, for Country/Region and City/Locality, select the information that applies to your district. Click Next.

On the Certificate Request File Name page, in the File Name field, accept the default location. Click Next.

Note the location of this file. You will need the file path when you install the certificate.

On the Request File Summary page, verify the information is correct. Click Next.

To request and retrieve a certificate:

Open your web browser and navigate to a vendor’s web site. Possible vendors are Verisign (www.verisign.com), Thawte (www.thawte.com), or Entrust (www.entrust.com).

Follow the instructions on the vendor’s web site for requesting a certificate and, later, for retrieving the certificate. When requesting a certificate, you will need the file created in step 12, above.

There is a fee for each certificate.

When you have retrieved your certificate, you are ready to install it on your Web Server.

To install the certificate:

On the Web Server, from the Start menu, click Programs > Administrative Tools > Internet Information Services Manager.

In the Internet Information Services dialog, expand the folders and right-click the Default Web Site. From the menu, select Properties.

In the Properties dialog, on the Directory Security tab, click Server Certificate.

In the Web Server Certificate Wizard, click Next until the Pending Certificate Request page displays.

On the Pending Certificate Request page, select Process the pending request and install the certificate. Click Next.

On the Process a Pending Request page, in the Path and File name field, enter the path where you recorded the certificate when you created the certificate request. Click Next.

On the Certificate Summary page, verify the information. Click Next, and then click Finish.

To secure the web site:

On the Web Server, from the Start menu, click Programs > Administrative Tools > Internet Information Services Manager.

In the Internet Information Services dialog, select and right-click the virtual directory you want to secure, such as Web Server or GBServer. From the menu, select Properties.

In the Properties dialog, on the Directory Security tab, in the Secure Communications section, click Edit.

On the Secure Communications dialog, select Require Secure Channel (SSL) and Require 128-Bit Encryption. Click OK.

To access the web site after it is secure, use "https" in the URL, not "http".