Error IIS SSL-Binding with selfsigned certififacte created within OctoDeploy

Hi there,
we have problems with “Deploy to IIS” and using a selfsigned certificate for ssl-binding on a Server 2019 / IIS-Target (certificate was created within octodeploy).

If we are using a wildcard-cert from a real CA the deployment is working.

We also tried to import the “Octo-Selfsigned-Certificate” to the IIS and tried to bind to ssl manually and got the following errors in IIS:

Internal Error: HRESULT: 0x8007054F

Same Time Event Log / System says:
A fatal error occurred while creating a TLS server credential. The internal error state is 10018.

It seems there is something wrong with the selfsigned certificate created by octodeploy, bot but sure… we hope you can help us :slight_smile:

Please see attached Task-Log (I replaced sensitive data, etc. with XYZ):

Task ID: ServerTasks-204950

Related IDs: Deployments-48284, Channels-1248, Releases-19249, Projects-1208, Spaces-1, Environments-581

Task status: Failed

Task queued: Freitag, 16 April 2021 8:39:27 +02:00

Task started: Freitag, 16 April 2021 8:39:27 +02:00

Task completed: Freitag, 16 April 2021 8:39:48 +02:00

Task duration: 21 seconds

Server version: 2020.5.5+Branch.tags-2020.5.5.Sha.259508a031a95a62ed2dc5c8c41759cdaaa55775

Server node: OCTOPUS02

                | == Failed: Deploy XYZ release 1.441-5 to XYZ ==

08:39:27 Verbose | Step 1.2: Deploy to IIS - INT & PROD does not apply to the current environment, and will not be executed

08:39:27 Verbose | Guided failure is not enabled for this task

08:39:48 Fatal | The deployment failed because one or more steps failed. Please see the deployment log for details.

                | 

                |   == Success: Acquire packages ==

08:39:27 Info | Acquiring packages

08:39:27 Info | Making a list of packages to acquire

08:39:27 Verbose | Package XYZ v1.44 is required by action ‘Deploy to IIS - DEV & TEST’

08:39:27 Verbose | No packages are required on the Octopus Server

08:39:27 Verbose | Delta compression is enabled for package transfers from the Octopus Server to deployment targets

08:39:27 Verbose | Machine XYZ still needs packages XYZ v1.44 for action (‘Deploy to IIS - DEV & TEST’)

08:39:29 Info | All packages have been acquired

08:39:29 Verbose | Acquire Packages completed

                |   

                |     Success: XYZ 

                |     

                |       Success: Upload package XYZ v1.44

08:39:27 Verbose | Checking package cache for package XYZ v1.44

08:39:27 Info | Package XYZ v1.44 was found in cache. No need to download from feed.

08:39:27 Verbose | Using file: C:\OctopusShare\Packages\Spaces-1\feeds-builtin\XYZ\XYZ.1.44.zip

08:39:27 Verbose | Executable directory is C:\Windows\system32\WindowsPowershell\v1.0

08:39:27 Verbose | Executable name or full path: C:\Windows\system32\WindowsPowershell\v1.0\PowerShell.exe

08:39:27 Verbose | No user context provided. Running as current user.

08:39:27 Verbose | Starting C:\Windows\system32\WindowsPowershell\v1.0\PowerShell.exe in working directory ‘C:\Octopus\Work\20210416063927-204950-633’ using ‘Western European (DOS)’ encoding running as ‘domain\appuser’ with the same environment variables as the launching process

08:39:28 Verbose | Process C:\Windows\system32\WindowsPowershell\v1.0\PowerShell.exe in C:\Octopus\Work\20210416063927-204950-633 exited with code 0

08:39:28 Verbose | Using Calamari.netfx 15.1.6

08:39:28 Verbose | Using Calamari.netfx 15.1.6

08:39:28 Verbose | Executable directory is C:\Windows\system32\WindowsPowershell\v1.0

08:39:28 Verbose | Executable name or full path: C:\Windows\system32\WindowsPowershell\v1.0\PowerShell.exe

08:39:28 Verbose | No user context provided. Running as current user.

08:39:28 Verbose | Starting C:\Windows\system32\WindowsPowershell\v1.0\PowerShell.exe in working directory ‘C:\Octopus\Work\20210416063928-204950-634’ using ‘Western European (DOS)’ encoding running as ‘domain\appuser’ with the same environment variables as the launching process

08:39:28 Info | When a script or process writes to error out on Windows 2019 (1809) with .NET 4.7.2 , PowerShell may terminate it immediately without allowing further code execution. This also causes only part of the error output to be shown… Install .NET 4.8 or later to resolve this problem. More information.

08:39:28 Verbose | Calamari Version: 15.1.6

08:39:28 Verbose | Environment Information:

08:39:28 Verbose | OperatingSystem: Microsoft Windows NT 10.0.17763.0

08:39:28 Verbose | OsBitVersion: x64

08:39:28 Verbose | Is64BitProcess: True

08:39:28 Verbose | CurrentUser: domain\tentacleuser

08:39:28 Verbose | MachineName: XYZ

08:39:28 Verbose | ProcessorCount: 2

08:39:28 Verbose | CurrentDirectory: C:\Octopus\Work\20210416063928-204950-634

08:39:28 Verbose | TempDirectory: C:\Users\XYZ\AppData\Local\Temp\

08:39:28 Verbose | HostProcess: Calamari (2084)

08:39:28 Verbose | Package XYZ 1.44 hash c892ca858136dae1c78fa18da9da2f9c1ba7e790 has already been uploaded

08:39:28 Verbose | Process C:\Windows\system32\WindowsPowershell\v1.0\PowerShell.exe in C:\Octopus\Work\20210416063928-204950-634 exited with code 0

08:39:28 Verbose | Exit code: 0

08:39:28 Info | Package XYZ version 1.44 found in cache. No need to upload this 8.325 MB package. Using C:\Octopus\Files\XYZ@S1.44@F5332D091D9C884589ADCC5847462A07.zip

                |       

                |   == Failed: Step 1: Deploy to each environment ==

08:39:48 Fatal | The step failed: Activity Deploy to IIS - DEV & TEST on XYZ failed with error ‘The remote script failed with exit code 1’.

08:39:48 Verbose | Deploy to each environment completed

                |   

                |     == Failed: XYZ ==

08:39:29 Verbose | Octopus Server version: 2020.5.5+Branch.tags-2020.5.5.Sha.259508a031a95a62ed2dc5c8c41759cdaaa55775

08:39:29 Verbose | Environment Information:

                |       IsRunningInContainer: False

                |       OperatingSystem: Microsoft Windows 10.0.14393

                |       OsBitVersion: x64

                |       Is64BitProcess: True

                |       CurrentUser: domain\tentacleuser

                |       MachineName: XYZ

                |       ProcessorCount: 4

                |       CurrentDirectory: C:\Windows\system32

                |       TempDirectory: C:\Users\XYZ\AppData\Local\Temp\

                |       HostProcessName: Octopus.Server

                |       PID: 3476

08:39:29 Verbose | Executing Deploy to IIS - DEV & TEST (type Deploy to IIS) on XYZ

08:39:29 Verbose | Executable directory is C:\Windows\system32\WindowsPowershell\v1.0

08:39:29 Verbose | Executable name or full path: C:\Windows\system32\WindowsPowershell\v1.0\PowerShell.exe

08:39:29 Verbose | No user context provided. Running as current user.

08:39:29 Verbose | Starting C:\Windows\system32\WindowsPowershell\v1.0\PowerShell.exe in working directory ‘C:\Octopus\Work\20210416063929-204950-635’ using ‘Western European (DOS)’ encoding running as ‘domain\appuser’ with the same environment variables as the launching process

08:39:29 Verbose | Process C:\Windows\system32\WindowsPowershell\v1.0\PowerShell.exe in C:\Octopus\Work\20210416063929-204950-635 exited with code 0

08:39:29 Verbose | Using Calamari.netfx 15.1.6

08:39:29 Verbose | Using Calamari.netfx 15.1.6

08:39:29 Verbose | Executable directory is C:\Windows\system32\WindowsPowershell\v1.0

08:39:29 Verbose | Executable name or full path: C:\Windows\system32\WindowsPowershell\v1.0\PowerShell.exe

08:39:29 Verbose | No user context provided. Running as current user.

08:39:29 Verbose | Starting C:\Windows\system32\WindowsPowershell\v1.0\PowerShell.exe in working directory ‘C:\Octopus\Work\20210416063929-204950-636’ using ‘Western European (DOS)’ encoding running as ‘domain\appuser’ with the same environment variables as the launching process

08:39:30 Info | When a script or process writes to error out on Windows 2019 (1809) with .NET 4.7.2 , PowerShell may terminate it immediately without allowing further code execution. This also causes only part of the error output to be shown… Install .NET 4.8 or later to resolve this problem. More information.

08:39:30 Verbose | Calamari Version: 15.1.6

08:39:30 Verbose | Environment Information:

08:39:30 Verbose | OperatingSystem: Microsoft Windows NT 10.0.17763.0

08:39:30 Verbose | OsBitVersion: x64

08:39:30 Verbose | Is64BitProcess: True

08:39:30 Verbose | CurrentUser: domain\tentacleuser
08:39:30 Verbose | MachineName: XYZ

08:39:30 Verbose | ProcessorCount: 2

08:39:30 Verbose | CurrentDirectory: C:\Octopus\Work\20210416063929-204950-636

08:39:30 Verbose | TempDirectory: C:\Users\XYZ\AppData\Local\Temp\

08:39:30 Verbose | HostProcess: Calamari (2620)

08:39:30 Info | Deploying package: C:\Octopus\Files\XYZ@S1.44@F5332D091D9C884589ADCC5847462A07.zip

08:39:30 Verbose | Extracting package to: C:\Octopus\Applications\XYZ\XYZ\1.44_5

08:39:31 Verbose | Extracted 118 files

08:39:31 Verbose | The file at C:\Octopus\Applications\XYZ\XYZ\1.44_5\appsettings.json matches a known filename pattern, and will be treated as Json.

08:39:31 Verbose | Attempting structured variable replacement on file C:\Octopus\Applications\XYZ\XYZ\1.44_5\appsettings.json with format Json

08:39:31 Verbose | Structure found matching the variable ‘Services:UserManagement:AppKey’. Replacing its content with the variable value.

08:39:31 Verbose | Structure found matching the variable ‘Services:XYZ:Username’. Replacing its content with the variable value.

08:39:31 Verbose | Structure found matching the variable ‘Services:XYZ:Url’. Replacing its content with the variable value.

08:39:31 Verbose | Structure found matching the variable ‘ConnectionStrings:XYZ’. Replacing its content with the variable value.

08:39:31 Verbose | Structure found matching the variable ‘XYZ:Environment’. Replacing its content with the variable value.

08:39:31 Info | Structured variable replacement succeeded on file C:\Octopus\Applications\XYZ\XYZ\1.44_5\appsettings.json with format Json

08:39:31 Verbose | The package has been installed to: C:\Octopus\Applications\XYZ\XYZ\1.44_5

08:39:31 Verbose | If you would like the package to be installed to an alternative location, please use the ‘Custom installation directory’ feature

08:39:31 Verbose | Executing feature-class ‘Calamari.Deployment.Features.IisWebSiteBeforeDeployFeature’

08:39:31 Verbose | Found existing certificate with thumbprint ‘77B50BCD133A1F60DEB1543F64F70186621807CE’ in Cert:\LocalMachine\My

08:39:31 Verbose | Creating ‘C:\Octopus\Applications\XYZ\XYZ\1.44_5\Octopus.Features.IISWebSite_BeforePostDeploy.ps1’ from embedded resource

08:39:31 Verbose | Executing ‘C:\Octopus\Applications\XYZ\XYZ\1.44_5\Octopus.Features.IISWebSite_BeforePostDeploy.ps1’

08:39:31 Verbose | Setting Proxy Environment Variables

08:39:31 Verbose | Name Value

08:39:31 Verbose | ---- -----

08:39:31 Verbose | PSVersion 5.1.17763.592

08:39:31 Verbose | PSEdition Desktop

08:39:31 Verbose | PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}

08:39:31 Verbose | BuildVersion 10.0.17763.592

08:39:31 Verbose | CLRVersion 4.0.30319.42000

08:39:31 Verbose | WSManStackVersion 3.0

08:39:31 Verbose | PSRemotingProtocolVersion 2.3

08:39:31 Verbose | SerializationVersion 1.1.0.1

08:39:32 Verbose | PowerShell Environment Information:

08:39:32 Verbose | OperatingSystem: Microsoft Windows NT 10.0.17763.0

08:39:32 Verbose | OsBitVersion: x64

08:39:32 Verbose | Is64BitProcess: True

08:39:32 Verbose | CurrentUser: domain\tentacleuser

08:39:32 Verbose | MachineName: XYZ

08:39:32 Verbose | ProcessorCount: 2

08:39:32 Verbose | CurrentDirectory: C:\Octopus\Applications\XYZ\XYZ\1.44_5

08:39:32 Verbose | CurrentLocation: C:\Octopus\Applications\XYZ\XYZ\1.44_5

08:39:32 Verbose | TempDirectory: C:\Users\XYZ\AppData\Local\Temp\

08:39:32 Verbose | HostProcess: powershell (6072)

08:39:32 Verbose | TotalPhysicalMemory: 8387564 KB

08:39:32 Verbose | AvailablePhysicalMemory: 6714812 KB

08:39:32 Verbose | Invoking target script C:\Octopus\Applications\XYZ\XYZ\1.44_5\Octopus.Features.IISWebSite_BeforePostDeploy.ps1 with parameters.

08:39:32 Verbose | Detected IIS Version 10.0

08:39:32 Info | Making sure a Website “XYZ” is configured in IIS…

08:39:32 Info | Finding SSL certificate with thumbprint 77B50BCD133A1F60DEB1543F64F70186621807CE

08:39:32 Info | Found certificate: CN=XYZ in: My

08:39:32 Verbose | Acquired mutex Global\Octopus-IIS-Metabase-Mutex

08:39:33 Info | A different binding exists for the IP/port combination, replacing…

08:39:33 Info | SSL Certificate successfully deleted

08:39:33 Info | SSL Certificate add failed, Error: 1359

08:39:33 Info | An internal error occurred.

08:39:33 Info | Attempt 1 of 5 failed: ScriptHalted

08:39:33 Info | Waiting for 3 seconds before retrying…

08:39:36 Info | Retrying…

08:39:36 Info | Adding a new SSL certificate binding…

08:39:36 Info | SSL Certificate add failed, Error: 1359

08:39:36 Info | An internal error occurred.

08:39:36 Info | Failed adding new SSL binding for certificate with thumbprint ‘77B50BCD133A1F60DEB1543F64F70186621807CE’. Exit code: 1

08:39:36 Info | Attempt 2 of 5 failed: ScriptHalted

08:39:36 Info | Waiting for 3 seconds before retrying…

08:39:39 Info | Retrying…

08:39:39 Info | Adding a new SSL certificate binding…

08:39:40 Info | SSL Certificate add failed, Error: 1359

08:39:40 Info | An internal error occurred.

08:39:40 Info | Failed adding new SSL binding for certificate with thumbprint ‘77B50BCD133A1F60DEB1543F64F70186621807CE’. Exit code: 1

08:39:40 Info | Attempt 3 of 5 failed: ScriptHalted

08:39:40 Info | Waiting for 3 seconds before retrying…

08:39:43 Info | Retrying…

08:39:43 Info | Adding a new SSL certificate binding…

08:39:44 Info | SSL Certificate add failed, Error: 1359

08:39:44 Info | An internal error occurred.

08:39:44 Info | Failed adding new SSL binding for certificate with thumbprint ‘77B50BCD133A1F60DEB1543F64F70186621807CE’. Exit code: 1

08:39:44 Info | Attempt 4 of 5 failed: ScriptHalted

08:39:44 Info | Waiting for 3 seconds before retrying…

08:39:46 Info | Retrying…

08:39:46 Info | Adding a new SSL certificate binding…

08:39:48 Info | SSL Certificate add failed, Error: 1359

08:39:48 Info | An internal error occurred.

08:39:48 Info | Failed adding new SSL binding for certificate with thumbprint ‘77B50BCD133A1F60DEB1543F64F70186621807CE’. Exit code: 1

08:39:48 Error | Calamari.exe : OperationStopped: ScriptHalted

08:39:48 Error | At C:\Octopus\Work\20210416063929-204950-636\Bootstrap.ps1:39 char:1

08:39:48 Error | + & “${env:TentacleHome}\Tools\Calamari.netfx\15.1.6\Calamari.exe” dep …

08:39:48 Error | + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

08:39:48 Error | + CategoryInfo : NotSpecified: (OperationStopped: ScriptHalted:String) [], RemoteException

08:39:48 Error | + FullyQualifiedErrorId : NativeCommandError

08:39:48 Error | At C:\Octopus\Applications\XYZ\XYZ\1.44_5\Octopus.Features.IISWebSite_BeforePostDeploy.ps1:570 char:7

08:39:48 Error | + throw

08:39:48 Error | + ~~~~~

08:39:48 Error | at , C:\Octopus\Applications\XYZ\XYZ\1.44_5\Octopus.Features.IISWebSite_BeforePostDeploy.ps1: line

08:39:48 Error | 570

08:39:48 Error | at Core-Execute-WithRetry,

08:39:48 Error | C:\Octopus\Applications\XYZ\XYZ\1.44_5\Octopus.Features.IISWebSite_BeforePostDeploy.ps1: line 125

08:39:48 Error | at Execute-WithRetry, C:\Octopus\Applications\XYZ\XYZ\1.44_5\Octopus.Features.IISWebSite_BeforePostDeploy.ps1:

08:39:48 Error | line 147

08:39:48 Error | at , C:\Octopus\Applications\XYZ\XYZ\1.44_5\Octopus.Features.IISWebSite_BeforePostDeploy.ps1: line

08:39:48 Error | 511

08:39:48 Error | at , C:\Octopus\Applications\XYZ\XYZ\1.44_5\Octopus.Features.IISWebSite_BeforePostDeploy.ps1: line

08:39:48 Error | 469

08:39:48 Error | at , : line 1

08:39:48 Error | at , C:\Octopus\Applications\XYZ\XYZ\1.44_5\Octopus.FunctionAppenderContext.ps1: line 179

08:39:48 Error | at , C:\Octopus\Applications\XYZ\XYZ\1.44_5\Bootstrap.Octopus.FunctionAppenderContext.ps1: line 1958

08:39:48 Error | at , : line 1

08:39:48 Error | at , : line 1

08:39:48 Verbose | Deleting ‘C:\Octopus\Applications\XYZ\XYZ\1.44_5\Octopus.Features.IISWebSite_BeforePostDeploy.ps1’

08:39:48 Verbose | Calamari.Common.Commands.CommandException: Script ‘C:\Octopus\Applications\XYZ\XYZ\1.44_5\Octopus.Features.IISWebSite_BeforePostDeploy.ps1’ returned non-zero exit code: 1

08:39:48 Verbose | at Calamari.Deployment.Conventions.FeatureConventionBase.ExecuteFeatureScripts(RunningDeployment deployment, String feature, HashSet`1 embeddedResourceNames)

08:39:48 Verbose | at Calamari.Deployment.Conventions.FeatureConventionBase.Run(RunningDeployment deployment)

08:39:48 Verbose | at Calamari.Deployment.ConventionProcessor.RunInstallConventions()

08:39:48 Verbose | at Calamari.Deployment.ConventionProcessor.RunConventions()

08:39:48 Error | Running rollback conventions…

08:39:48 Verbose | Adding journal entry:

08:39:48 Verbose |

08:39:48 Verbose |

08:39:48 Verbose |

08:39:48 Error | Script ‘C:\Octopus\Applications\XYZ\XYZ\1.44_5\Octopus.Features.IISWebSite_BeforePostDeploy.ps1’ returned

08:39:48 Error | non-zero exit code: 1

08:39:48 Verbose | Process C:\Windows\system32\WindowsPowershell\v1.0\PowerShell.exe in C:\Octopus\Work\20210416063929-204950-636 exited with code 1

08:39:48 Verbose | Updating manifest with output variables

08:39:48 Verbose | Updating manifest with action evaluated variables

08:39:48 Fatal | The remote script failed with exit code 1

08:39:48 Fatal | The action Deploy to IIS - DEV & TEST on XYZ failed

Hi @bennyk,

Thanks for getting in touch!

If you create a self-signed certificate outside of Octopus and try and bind that manually on the target machine do you also encounter this problem?

The error suggests that there may be some security settings on the target machine blocking the certificate from being added. Some Google results suggest that enabling FIPS compliant algorithms for encryption, hashing, and signing may resolve the problem. (A fatal error occurred while creating an SSL client credential. The internal err).

Regards,
Paul

Hi Paul,
thank you!

I didnt try to use another selfsigned certificate (created outside of octodeploy) yet.
I just tried to import and ssl-map the “octo-cert” on two different machines (one in business-environment and the other fresh installed locally with virtualbox) without success.

I also did some research and tried the FIPS-Workaround, but this also didnt work :frowning:

BR Benjamin

I’ve run a test on this on our latest version and I am seeing the same issue.
I will raise this with our engineers to investigate further.

I imagine it will work fine if you create the self-signed certificate outside of Octopus and then import it into the Octopus cert library.

Hi Paul,

thank you! Glad to hear that this is a “common” problem.
We are looking forward to hear from you, soon :slight_smile:

I also wrote to support via email. Just to let you know :slight_smile:

Best Regards
Benjamin

1 Like

This topic was automatically closed 31 days after the last reply. New replies are no longer allowed.