IIS Web site deployment fails for binding with certificate variable scoped to tenant

Legacy Execution
1

We are converting a project to use tenants. I have configured an IIS step to bind to an Octopus-managed certificate variable, which is set as a variable template for each tenant (for some customers, we host the app on their domain name which obviously needs their own certificate). This technique works well for other variable types but doesn’t seem to work for certificate variables. The deployment fails with the following error:

System.ArgumentNullException: Value cannot be null.
Parameter name: findValue
at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.FindCertInStore(SafeCertStoreHandle safeSourceStoreHandle, X509FindType findType, Object findValue, Boolean validOnly)
at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Find(X509FindType findType, Object findValue, Boolean validOnly)
at Calamari.Deployment.Features.IisWebSiteBeforeDeployFeature.FindCertificateInLocalMachineStore(String thumbprint)
at Calamari.Deployment.Features.IisWebSiteBeforeDeployFeature.EnsureCertificateInStore(VariableDictionary variables, String certificateVariable)
at Calamari.Deployment.Features.IisWebSiteBeforeDeployFeature.EnsureCertificatesUsedInBindingsAreInStore(VariableDictionary variables)
at Calamari.Deployment.Features.IisWebSiteBeforeDeployFeature.Execute(RunningDeployment deployment)
at Calamari.Deployment.Conventions.FeatureConventionBase.ExecuteFeatureClasses(RunningDeployment deployment, String feature)
at Calamari.Deployment.Conventions.FeatureConventionBase.Run(RunningDeployment deployment)
at Calamari.Deployment.ConventionProcessor.RunInstallConventions()
at Calamari.Deployment.ConventionProcessor.RunConventions()
Running rollback conventions…
Value cannot be null.
Parameter name: findValue
System.ArgumentNullException
at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.FindCertInStore(SafeCertStoreHandle safeSourceStoreHandle, X509FindType findType, Object findValue, Boolean validOnly)
at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Find(X509FindType findType, Object findValue, Boolean validOnly)
at Calamari.Deployment.Features.IisWebSiteBeforeDeployFeature.FindCertificateInLocalMachineStore(String thumbprint)
at Calamari.Deployment.Features.IisWebSiteBeforeDeployFeature.EnsureCertificateInStore(VariableDictionary variables, String certificateVariable)
at Calamari.Deployment.Features.IisWebSiteBeforeDeployFeature.EnsureCertificatesUsedInBindingsAreInStore(VariableDictionary variables)
at Calamari.Deployment.Features.IisWebSiteBeforeDeployFeature.Execute(RunningDeployment deployment)
at Calamari.Deployment.Conventions.FeatureConventionBase.ExecuteFeatureClasses(RunningDeployment deployment, String feature)
at Calamari.Deployment.Conventions.FeatureConventionBase.Run(RunningDeployment deployment)
at Calamari.Deployment.ConventionProcessor.RunInstallConventions()
at Calamari.Deployment.ConventionProcessor.RunConventions()
at Calamari.Commands.DeployPackageCommand.Execute(String[] commandLineArguments)
at Calamari.Program.Execute(String[] args)
The remote script failed with exit code 100

While trying to troubleshoot I updated to latest Octopus Server (3.16.7), and I also tried installing the certificate in question into the machine certificate store, even though the docs suggest that shouldn’t be necessary. Unfortunately neither of these helped…

Please see attached screenshots of all the relevant configuration, and also the deployment log. Is there anything I’m doing wrong?

variable_template.png
variable_template.png625×734 39.1 KB

tenant_variables.png
tenant_variables.png811×346 25.8 KB

ServerTasks-25831.log.txt (297 KB)

process.png
process.png742×362 20.3 KB

process.png
process.png742×362 20.3 KB

process.png
process.png742×362 20.3 KB

2

Hi Jon,

Sorry for the delay in getting this reply to you!

It turns out that the issue here is in how you have formatted your variable when defining it in the SSL Binding. Instead of using the standard Octopus variable encoding (#{sslCertificate}) it should be just the name of the variable itself (sslCertificate) without any variable encoding around it.

I’ve attached a screenshot of the Bindings screen with an example of the correct formatting.

Apologies for the confusion here, please let me know if this doesn’t resolve your issue.

Regards

Alex

Binding.png
Binding.png1808×1608 230 KB

3

Hi Jon,

Apologies, I accidentally closed this discussion when posting the reply. This message is just to re-open the conversation to allow for any follow up questions.

Regards
Alex

4

Ahh brilliant, that wasn’t intuitive…

Thanks very much for your help Alex :slight_smile:

5

Hi Jon,

No problems, glad we got that sorted out!

Happy deploying,

Regards,

Alex