SSL Certificate Considerations
Typically, this Passwordstate App Server will be installed in your DMZ, and you will then permit access to this website from outside your network, by opening your firewall on Port 443 by default, and having an external functioning DNS entry. There are two reasons for this:
- Users on mobile phones or tablets that aren’t joined to your domain can connect to the AppServer, and use the Mobile App
- Users can access the Self Destruct Messages portal from any machine outside your network, from any internet connection, and read Self Destruct Messages.
When installing the App Server, it will create a new website in IIS called passwordstateappserver. If IIS has not been installed already, the installer will automatically set up and configure IIS for you.
The installer will create a Self-Signed Certificate using the name of the URL that you have entered during the install process.
It is highly recommended you change this certificate and use a purchased SSL certificate and assign it to your passwordstateappserver website, to ensure functional use of the Mobile App. Also, if you intend on accessing your Self Destruct Portal using the Passwordstate App Server, instead of the embedded Self Destruct Portal, then you should also assign a purchased trusted certificate from an online authority.
The Self Signed certificate that comes with the installer or even a certificate issued by your internal Certificate Authority will present issues for your end users, as the devices from outside the network will not trust these certificates.
If your URL for the App Server is https://appserver.contoso.com, then you should use a certificate with a matching name of appserver.contoso.com, or even a wildcard certificate of *.contoso.com.