Show All

Hide All

Using Client Certificates When Crawling Content

Additional information about this feature will be provided on the Web. For the latest information, see http://www.microsoft.com/SharePoint/Assistance.

Crawling content with client certificates is another way of allowing the portal site to authenticate when it is crawling content. Setting up client certificates requires configuration both inside and outside of the portal site.

Note  To perform the following procedures on the index management servers and the front-end Web servers, you must be a member of the local Administrators group on the server on which you are performing the procedure.

Use client certificates when crawling content

1. Enable Secure Sockets Layer (SSL) on all front-end Web servers on the server farm.

   For more information, see Enabling Secure Sockets Layer.

2. Obtain a client certificate.

   Obtain a client certificate that is valid for crawling a site. The certificate must be a Personal Information Exchange type certificate (*.pfx).

   Important  Each client certificate that you want to use for crawling must have a unique "issued to" name.

3. Export the client certificate.

   Export the client certificate with the private key (*.pfx file) to use on the index management servers. Export the client certificate without the private key (*.cer file) to use on the front-end Web servers.

4. Configure the front-end Web servers to use client certificates.

   For more information see Using Server and Client Certificates for SSL.

5. Import the certificate to the Personal certificate store for the Local Computer.

   Do the following on the index management server on which the index containing the content source that requires the certificate is located:

   1. On the taskbar, click Start, and then click Run.
   2. Type mmc and then click OK.
   3. In the console, on the File menu, click Add/Remove Snap-in.
   4. In the Add/Remove Snap-in dialog box, on the Standalone tab, click Add.
   5. In the Add Standalone Snap-in dialog box, in the Available Standalone Snap-ins list, click Certificates, and then click Add.
   6. In the Certificates snap-in dialog box, click Computer account, and then click Next.
   7. In the Select Computer dialog box, click Local computer: (the computer this console is running on), and then click Finish.
   8. Click Close to close the Add Standalone Snap-in dialog box.
   9. Click OK to close the Add/Remove Snap-in dialog box.
   10. Expand the Certificates (Local Computer) node.
   11. Right-click Personal, point to All Tasks, and then click Import.
   12. On the Welcome to the Certificate Import Wizard page, click Next.
   13. On the File to Import page, specify the location of the certificate in the File name box, and then click Next.

       Note  The certificate must be a Personal Information Exchange type certificate (*.pfx).

       Important  Each client certificate that you want to use for crawling must have a unique "issued to" name.

   14. On the Password page, type the password for the certificate in the Password box, and then click Next.
   15. On the Certificate Store page, do the following:
       1. Click Place all certificates in the following store.
       2. In the Certificate store box, specify Personal.
       3. Click Next.
   16. On the Completing the Certificate Import Wizard page, click Finish.
   17. Click OK to close the message box.

6. Ensure that the Certificate Authority is listed in the Trusted Root Certification Authorities certificate store.

   To avoid being challenged for the validity of the certificate, you must have the Certificate Authority listed in the Trusted Root Certification Authorities certificate store.

   You can check to see if the Certificate Authority is listed by doing the following on the index management server:

   1. Open the Certificates snap-in that you created in step 5 (Import the certificate to the Personal certificate store for the Local Computer).
   2. Expand the Certificates (Local Computer) node.
   3. Expand the Personal node, and then click Certificates.
   4. In the detail pane, double-click the client certificate that you imported.

      The Certificate dialog box appears.

   5. On the General tab, if there is a red circle with an X in it next to Certificate Information, the Certificate Authority is not listed in the Trusted Root Certification Authorities certificate store.

   If the Certificate Authority is not listed in the Trusted Root Certification Authorities certificate store, do the following on the index management server on which the index containing the content source that requires the certificate is located:

   1. Open the Certificates snap-in that you created in step 5 (Import the certificate to the Personal certificate store for the Local Computer).
   2. Expand the Certificates (Local Computer) node.
   3. Right-click Trusted Root Certification Authorities, point to All Tasks, and then click Import.
   4. On the Welcome to the Certificate Import Wizard page, click Next.
   5. On the File to Import page, specify the location of the certificate in the File name box, and then click Next.

      Note  The certificate must be a Personal Information Exchange type certificate (*.pfx).

   6. On the Password page, type the password for the certificate in the Password box, and then click Next.
   7. On the Certificate Store page, do the following:
      1. Click Place all certificates in the following store.
      2. In the Certificate store box, specify Trusted Root Certification Authorities.
      3. Click Next.
   8. On the Completing the Certificate Import Wizard page, click Finish.
   9. Click OK to close the message box.

7. Specify permissions for the certificate.

   There is a tool called WinHTTPCertCfg.exe that you use to specify permissions for a certificate. You can download this tool from MSDN. This tool enables the account specified to use the private key to access the Web site that you want to crawl.

   In the following procedure, use the configuration database administration account for DOMAIN\account.

   1. Download WinHTTPCertCfg.exe to the index management server on which the index containing the content source that requires the certificate is located.
   2. Open command prompt.
   3. Navigate to the location of WinHTTPCertCfg.exe.
   4. Type WinHttpCertCfg.exe -g -c LOCAL_MACHINE\MY -s certificate_name -a DOMAIN\account and then press ENTER.

8. Add a rule that includes or excludes content on the content index that you want to use a certificate for crawling.

   For more information, see Adding a Rule That Includes or Excludes Content.

9. Start a full update of the content source.

   For more information, see Starting a Full Update of a Content Source.