Root Cause & Analysis

The issue happens because of one or combination of the following:

• The SSL certificate binding on IIS is set to "Not Selected" automatically.

  

  ^{Click the image to enlarge.}

• A legacy SSL certificate hash property interfering with the current SSL binding, resulting in the correct binding being deleted.

  

  ^{Click the image to enlarge.}

• The IIS configuration files contain Metabase configuration entries that were previously being used by lower versions of IIS and are conflicting with the desired configuration.

Solution

1. Delete the unwanted/outdated metabase configuration entries from IIS configuration file "applicationHost.config":
   1. Go to "%WINDIR%\system32\inetsrv\config":
       

      Create a backup of the "applicationHost.config" file before proceeding to the next steps.

       

      

      ^{Click the image to enlarge.}

   2. Open "applicationHost.config" on a text editor (e.g. Notepad).
   3. Look for the <CustomMetaData> section then under the <key path="LM/W3SVC/xxxxx"> sections, delete entries with the following property IDs:
      • <property id="5511"....../>
      • <property id="5506"..... />
       

      Property ID meanings and references:

      • Property ID 5511 means SSLStoreName
        Reference: https://docs.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms525311%28v%3dvs.90%29
      • Property ID 5506 means SSLCertHash
        Reference: https://docs.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms525719%28v%3dvs.90%29

       

      Below are samples of the entries that should be deleted:
      <property id="5511" dataType="String" userType="1" attributes="Inherit" value="MY" />
      <property id="5506" dataType="Binary" userType="1" attributes="Inherit" value="uDTm2zEWuz+PYHKI6VeoL4XGlgc=" />

   4. After deletion, the section should look like this:
      Desired Output

         
      <key path="LM/W3SVC/200">
      <property id="1018" dataType="DWord" userType="1" attributes="Inherit" value="1" />
      
      </key>
      

2. Re-configure the desired SSL certificate binding.
3. Restart IIS website (MDM Web Site) and Mobile Security Management Module service.
4. The web management console should now be accessible after doing the changes.