ssl certificate does not work

udi.moshe_0021

to answer your questions:

i use the default configuration and binding. i bind it to port.
no reverse proxy. i configured proget to get out using proxy but to get into proget there is no proxy.
i use local computer account configured as administrator.

i ran the command you suggested. upon configuring proget to use pfx, there is no error displayed other than "... path to object not found". upon trying to configure it to use windows cert store i got error of "task cancelation...". if you need the full error i will provide it on sunday next week.

thanks,
udi

rhessinger

Hi @udi-moshe_0021,

If you could please share all of the output, that would be helpful.

Thanks,
Rich

steviecoaster

Hey @udi-moshe_0021,

My InedoOps PowerShell module has a Set-ProGetSSLConfig function that helps setups ProGet to server up content via HTTPS.

The nice thing about this particular function is that, since it doesn't interact with ProGet's web interface, but rather configuration, it can be ran standalone.

You can find the function here: https://github.com/steviecoaster/InedoOps/blob/main/source/public/Utility/Set-ProGetSSLConfig.ps1

The first example is likely the one you'll want to follow, but pay attention to the URL parameter and adjust it as needed as you'll likely want to use https://*:443/ for the value (or whatever port you typically serve SSL traffic over to ProGet).

As mentioned by @rhessinger this is likely a permissions issue on the private key, which the above handles for you.

Hope that helps!

udi.moshe_0021

hi @steviecoaster ,

i will try this powershell and let you know.
will add the output as well.

thanks,
udi

udi.moshe_0021

Hi,

i can confirm that we have upgraded to 2nd latest version and it still does not work.
i haven't tried the script because i can see that the config file is updating according to my configuration but still does not work.
i have tried binding to another port and configure the certificate to use pem and tried with and without password for the private key in pem format. problem not solved.

i will upload the error we get.
thanks,
udi

udi.moshe_0021

another update...
i have noticed that the configuration is changed in the config file but it did not change in the configuration section in the admin console ui.
college of mine combined private key (without password) and public key under the name and path of the old successful file and it worked with the new certificate when trying to configure the same files uncombined, it failed as mentioned in the previous post.

hope this will give you some direction to solve this problem.
thanks,
udi

steviecoaster

It seems like you are dancing around the fact that this is permissions issue on the private key. This is a windows host, correct? and you are attempting to use a certificate that is inside an Windows Certificate store?

If so I urge you to try the code I linked, instead of fighting it :)

udi.moshe_0021

@steviecoaster ,
thank you for your time. i have downloaded the script and checked it and it has a lot of references to the internet and it will be difficult for me to run it as is.
i am using windows and as stated in the previous threads, i have tried any combination except for using thumbprint and no luck what so ever even when i used unencrypted key so i am trying to understand what are the permission issues you see.

steviecoaster

The issue on windows is that the Service user running the Inedo web service doesn't have permissions to the private key on WIndows. The script can run 100% offline standalone. There are 0 references to the internet inside of it. The only way you would need the internet to use it is if you use Install-Module to install the entire InedoOps module, which you do not need to do. You could simply copy the function, and run it.

It is obviously good practice to read any code you find online before you blindly run it, but there are 0 references to the internet. Unless you are referring to the -Urls parameter. That is so you can control what port your ProGet web interface is bound too with your SSL certificate, not the internet in general.

steviecoaster

It just occured to me that you probably only need the Set-CertPermission function. If you're just renewing a cert, everything else should be fine in your config.

You can call this on its own as well: https://github.com/steviecoaster/InedoOps/blob/main/source/private/Set-CertPermissions.ps1

udi.moshe_0021

@steviecoaster ,
regarding the internet references in the script, i want to straight things up. i have right clicked on the link and pressed on "save as..." and it downloaded the whole html page. i entered into the link and downloaded the script itself. i will run the script and see if it helps.

10x

steviecoaster

Ah, that makes more sense! Yeah, Github is weird like that. I think if I provided the raw link then that right-click would have worked. Sorry for the confusion!

Jonathan.Engstrom

@udi-moshe_0021 Hello, did you have any luck getting this to work? I am trying to get the certificate to work as well for testing. I would appreciate any feedback. I will probably try @steviecoaster scripts as well to see if that works. I am running 2025.5 and I am using IIS as a reverse proxy to get SSL to work. Less than desirable but we need to get this secured. Thanks!

udi.moshe_0021

@Jonathan-Engstrom Hi,

unfortunately, i didn't had the time to try and fix it and we kind of left it like it is.
it troubles me that you have the same problem in the latest version too.

Jonathan.Engstrom

My fix unfortunately was to fall back to 2024.39 and use IIS with SQL 2022. I wish I could of used postgres, but I really don't have time to geek out on this; I need it to just work and be secured with ssl. The URL rewrite made some weird things happen, something to do with compression. Once proget was installed, I deleted the default site, added a binding on the proget site for 443, removed the http and it just worked. Getting ssl to me is more valuable than whatever benefits that IWS provide, which to me don't appear to be any. IWS is like a black box, with no logs and no management. So until ssl works with a "Web Server" certificate template issued from our Active Directory Certificate Service on IWS, this is a hard no-go for me.

@steviecoaster Thanks for providing those links, but I am not sure they are up to date for for IWS and/or proget 2025? Also, the Set-CertPermissions.ps1, are you doing that to a certificate that's already in the store, or exporting it and applying acl's to it and then point the IWS certificate to use that while not imported into the store? I am figuring the latter as one get the location based on just the thumbprint alone. Also, some examples and filling out the help would be great too. Thank you for this work, it is appreciated.

steviecoaster

@Jonathan-Engstrom something like this? https://steviecoaster.github.io/Pagootle/Commands/Set-ProGetSslConfig/

steviecoaster

I recently published a new version of Pagootle that supports working with Asset directories, includes some other fixes, and improves the documentation.

Jonathan.Engstrom

For those that are still interested, I did finally manage to get this to work on Proget 2025.8. This is what I had to do. First, you need to create your own certificate template based off the default Web Server template, and make sure you can export the private keys, and most importantly add Client Authentication to the template as it will not work if you don't. I also added the computer name account on the security tab to be able to "Enroll" the certificate. On my issuing certificate authority, I went into Certification Authority MMC, and under "Certificate Templates" right click and under New- Certificate template to issue. After adding the template you just created, go to the windows server you are running this under and open up certlm.msc. Under Personal- Certificates right click "Request New Certificate". Find your certificate you created under the AD Enrollment Policy. Add subject name, and make sure to add the netbios name and fqdn under dns. Give it a subject name like Proget or something else to make it stand out. You should be able to accept the rest of the defaults. Make sure the "Client Authentication" is with "Server Authentication" or it won't work. After that is done, right click your new certificate All Tasks-Manage Private Keys and add "Network Service" and give it full control. After that, your certificate is ready. In ProGet, add the certificate from the computer personal store under "My" and after that, you should be able to access it under https://server.domain.local:8625. You should be in and should have a secure connection at that point.