SSL connection / Reset connection with IISExpress

Question

This is the first time I'm using a new Visual Studio 2013 with IISExpress (the previously used ASP.net Development server on VS2010). I have problems trying to debug my project.

This is what I see in Chrome:

Unable to make a secure connection to the server. This may be a server problem, or you may need a client authentication certificate that you do not have. Error Code: ERR_SSL_PROTOCOL_ERROR

I updated my own website -> web file so that the project url now uses https url. However, after that, now I get a new error at startup:

The connection to localhost was interrupted. Error Code: ERR_CONNECTION_RESET

thank

Answer 1

If you use URLRewrite to force SSL in your web.config, it will probably rewrite your localhost address to force https. If debugging with SSL enabled is not important to you and you are using URLRewrite, consider adding <add input="{HTTP_HOST}" pattern="localhost" negate="true" /> to the rewrite section of the web.config file. It will stop rewriting for any localhost addresses, but leave it in place in the production environment. If you are not using URLRewrite or you need to debug using SSL, http://www.hanselman.com/blog/WorkingWithSSLAtDevelopmentTimeIsEasierWithIISExpress.aspx can help. It is for VS2010, but should be sufficient for VS2013.

Answer 2

I was getting ERR_CONNECTION_RESET because my configured Visual Studio 2013 / IIS Express application did not have a port number in the range : 44300-: 44398 . (I don’t remember to dismiss any warnings to get out of this range.) Changing the port number to something in this range is all I had to do to make it work.

I noticed this after looking at the output of netsh http show sslcert > sslcert.txt and something clicking on things I recently read about port numbers.

Answer 3

Be sure to remove all previous "localhost" certificates, as they may conflict with the one that IIS Express created. I had the same error (ERR_SSL_PROTOCOL_ERROR), and it took me many hours to finally understand it, having tried many “solutions”. My mistake was that I created my own localhost certificate, and there were two of them. I had to uninstall both and upgrade IIS Express.

Here is how you can verify and remove the "localhost" certificate:

• In the Start field, enter → mmc.exe
• File → Add / Remove Snap-in ...
• Click Certificates → Add> → Computer Account → Local Computer
• Check Certificates> Personal> Certificates
• Ensure that the existing localhost certificate has the friendly name IIS Express Development Certificate. If not, delete it. Or if several, delete everything.

In Visual Studio, select the tab "Project" and "Properties", enable SSL = true. Save, build and run. IIS Express will create a new "localhost" certificate.

Note. If this does not work, try the following: be sure to disable IIS Express in the VS project and stop the entire running application before deleting the localhost certificate. Alternatively, you can go to "Control Panel> Programs" and "Restore IIS Express."

Answer 4

I summarize the steps that helped me solve this problem:

1. Verify that the SSL port range (used by IIS express) is between 44300-44398

During installation, IIS Express uses Http.sys to reserve ports 44300 through 44399 for using SSL. This allows regular users (without elevated privileges) of IISExpress to configure and use SSL. See here for more details.

2. Run the command below as an administrator at a command prompt. This will output the SSL certificate bindings to the computer. From this list, find the certificate used by IIS express for the corresponding port:

netsh http show sslcert> sslcert.txt

3. Locate the following items in the sslcert.txt file (in my case, IIS Express was running on port 44300)

IP: port : 0.0.0.0-00-004300

Certificate Hash : eb380ba6bd10fb4f597cXXXXXXXXXX

Application ID : {214124cd-d05b-4309-XXX-XXXXXXX}

4. Also, look in the IIS Express management console (RUN (Ctrl + R) → inetmgr.exe) and find out if the corresponding certificate exists in the server certificates.

(Click on ServerRoot → under IIS () → Open Server Certificates)

5. If your localhost uses a different certificate by default than the certificate specified in step 3, go to the next steps

netsh http delete sslcert ipport = 0.0.0.0: 44300

netsh http add sslcert ipport = 0.0.0.0: 44300 certhash = New_Certificate_Hash_without_space appid = {214124cd-d05b-4309-XXX-XXXXXXX}

New_Certificate_Hash will be your default certificate associated with your local host (which we found in step 4) or the one you want to add as a new certificate.

PS Thank you for your answer uosɐſ (which helped me solve this problem)

Answer 5

The problem I ran into is at some point in my case, allowing HSTS for the local host and not realizing that it will break my http: // localhost: someport in IIS Express.

HSTS tells the browser (Chrome in my case) to ALWAYS request a URL using HTTPS. Therefore, although I did not even enable SSL for my MVC 5 application, the browser will still try to access my site using HTTPS in the URL instead of HTTP.

Correction?

• Surf to chrome: // net-internals / # hsts
• In the delete section, enter "localhost" and delete the entry from Chrome.

Answer 6

None of the above options worked for me. I had to do the following:

• Remote IIS Express 8.0
• Removed all configurations in the My Documents folder for IIS Express
• Reinstall IIS Express 8.0
• Deleted a project on my local computer and uploaded a clean version for TFS
• Run the project - it went over SSL and I can debug

I got the steps of this thread.

Hope this helps.

Answer 7

In my case, I created a self-signed certificate and had it work, except that I received an error in the browser because the certificate was not reliable. So, I moved the certificate to the "Verified Root Certificate Authorities"> "Certificates" folder in the snapin certificates. This worked, and then I closed Visual Studio for a day.

The next day I started my project and I got the error mentioned in the original question. The problem is that the certificate that you configured IISExpress must exist in the Personal> Certificates folder or HTTPS will stop working. After successfully launching IIS Express, you can drag the certificate back to a safe place. It will work until you restart IIS Express.

Not wanting to fuss with dragging the certificate back and forth each time, I just put a copy of the certificate in both places, and now everything works fine.

Answer 8

I have the same problem in Visual Studio 2015. Since I use SSL binding in web.config

 <rewrite> <rules> <rule name="HTTP to HTTPS Redirect" stopProcessing="true"> <match url="(.*)" /> <conditions> <add input="{HTTPS}" pattern="off" /> </conditions> <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Found" /> </rule> </rules> </rewrite> 

And I can fix this problem with Mr. Jerger's answer. Replacing

 <add input="{HTTPS}" pattern="off" /> 

from

<add input="{HTTP_HOST}" pattern="localhost" negate="true" />

in my web.config, so my code is

 <rewrite> <rules> <rule name="HTTP to HTTPS Redirect" stopProcessing="true"> <match url="(.*)" /> <conditions> <add input="{HTTP_HOST}" pattern="localhost" negate="true" /> </conditions> <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Found" /> </rule> </rules> </rewrite> 

Answer 9

I had this problem, I configured my site for a global https request in FilterConfig.cs.

 public static void RegisterGlobalFilters(GlobalFilterCollection filters) { filters.Add(new HandleErrorAttribute()); filters.Add(new RequireHttpsAttribute()); } 

I forgot to change the project URL to https: from this tutorial http://azure.microsoft.com/en-us/documentation/articles/web-sites-dotnet-deploy-aspnet-mvc-app-membership-oauth-sql-database / under ENABLE SSL 4. This caused the errors that you were.

Answer 10

Another problem that happened to me twice:
In IIS Express applicationhost.config order of the bindings matters. One binding may take precedence over SSL binding, which makes it inoperative.

Example:

 <site name="MySite007" id="1"> <application path="/" applicationPool="Clr4IntegratedAppPool"> <virtualDirectory path="/" physicalPath="C:\Users\myuser\projects\mysolutionfolder\MyProject.Service" /> </application> <bindings> <binding protocol="http" bindingInformation=":8081:localhost" /> <binding protocol="http" bindingInformation=":8080:" /><!-- evil binding --> <binding protocol="https" bindingInformation="*:44327:localhost" /> </bindings> </site> 

You may have added a binding similar to the second in order to access your WebService from outside localhost . Since this binding is tapped on any address, it seems to undo the SSL binding, although a different port was used.

Remove the evil attachment or move it down.

Answer 11

This is anecdotal, like eavesdropping from a colleague, but presumably this is a problem with https chrome-forcing. I usually run in firefox, so I have not seen this problem before. Using firefox, etc. Worked for my employee.

Answer 12

My problem was caused by Fiddler. When Fiddler crashes, it sometimes gets confused with the proxy settings. Just starting Fiddler seemed to fix everything (maybe it was repairing itself somehow).

Answer 13

I would just rebuild my computer. This thread gave me hints, where I understood in the project settings> Web, the project was configured to use HTTP and HTTP port. Upgrading it to HTTPS and the correct HTTPS port, it worked again.

Answer 14

To go to other answers about configuring an SSL port between 44300 and 44399, I was unable to change the SSL Enabled property in Visual Studio and not set a specific SSL URL. Other answers, such as repairing IIS Express, did not help. The solution was to enter the .vs folder in parallel with the sln file, open the config subfolder, and then edit the applicationhost.config file. Then I added the https line manually and restarted VS.

 <binding protocol="http" bindingInformation="*:24941:localhost" /> <binding protocol="https" bindingInformation="*:44301:localhost" /> 

Answer 15

" " Verifying the installation of a Digicert certificate "often helps in such situations.

I was able to verify that the SSL certificate attempt was the one I was expecting when comparing the serial number.

For me, Jason Kleban's answer was a real problem, but it can be a very useful utility for checking your basic statements about which certificate is being downloaded.

Answer 16

In my case, I just forgot that I had a binding for (in my case) https: // localhost: 44300 in full IIS. You can't have both!

Answer 17

Removing IISExpress and vs directories and using the ssl port range from 44300 to 44399 (inclusive) from this article worked for me

Answer 18

If you need to use a port outside the range of 44300-44399, here is a workaround:

• Create a new site in IIS (not Express)
• Bind HTTPS to the desired port
• For SSL certificate, select IIS Express Development Certificate.
• Once the site is created, stop it, as it really should not be running

This registers the IIS Express Development certificate with this port and is the easiest way to get around the requirements of the 44300-44399 range.

Answer 19

In my case, the local URL was redirected to https: // localhost when I was debugging. This happened from one moment to another, without changing anything. I solved this problem by restarting the browser. Here is the link