Hey guys! I'm having some trouble setting up SSL and I wanted to see if anyone had any suggestions.

My goal is to secure two different types of communication:

• External communication between end-user's browsers and Laserfiche Forms. For this I have purchased a third-party certificate from a commonly-trusted CA and installed it on my Web server that hosts Forms (within the local computer's "personal" store).
• Internal communication between various Laserfiche components within my network (e.g., between thick clients and LFS, between Workflow and LFS). For this I have used the Microsoft SDK's makecert tool to create a self-signed certificate and installed the certificate on the relevant machine (within the local computer's "personal" store).

What is interesting (and annoying!) is that I can get either of the above communication lines secured individually, but not both at the same time. In other words, one certificate seems to break the other. I know that sounds abstract and confusing, so below is a bit more detail.

In IIS, if I select the default Web site, choose Bindings, and set the https binding to point at the third-party certificate, that successfully configures the browser-to-Forms communication to occur over SSL (I see the "lock" icon in Chrome when visiting Forms and can confirm that the correct certificate is being used). However, this configuration breaks the Laserfiche components from being able to communicate over SSL (they each throw a SSL Host Name Does Not Match Certificate Host Name error).

However, if I change the IIS binding to instead point at the self-signed certificate, then the Laserfiche components communicate just fine over SSL (e.g., I see the "lock" icon in the thick client), but then Forms obviously isn't using the correct certificate (and using a self-signed certificate for Internet traffic is obviously a terrible idea).

In my case, everything is installed on the same machine (Forms, Workflow, LFS, IIS, etc.). I realize that this may negate the need to use SSL between the various Laserfiche components (since all traffic is occurring over localhost), but I'd still like to at least understand why I can't get this working.

In case it is relevant, note that I'm using the following commands to create the self-signed certificate:

To create the CA:

makecert -pe -n "CN=my_ca_name" -ss ROOT -sr LocalMachine -a sha1 -sky signature -r "C:\my_ca_name.cer"

To create the client certificate:

makecert -pe -n "CN=localhost" -ss my -sr LocalMachine -a sha1 -sky exchange -eku 1.3.6.1.5.5.7.3.1 -in "my_ca_name" -is ROOT -ir LocalMachine -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 myhost.cer

To create the configuration record:

netsh http add sslcert ipport=0.0.0.0:443 certhash=thumbprint_value_without_spaces appid={my_guid}

Any help would be much appreciated!