Unable to load SSL filter in IIS5.0 (sspifilt.dll)

My Win2K professional (SP4) machine runs an IIS5.0 web server with
Frontpage2K extensions. Everything works OK except that I can't get SSL
to work. I installed a certificate following the MS guidelines. BUT:

The ISAPI tab via the web server properties in the IIS manager shows a
big fat red arrow pointing down. The priority is *Unknown*. The SSL
filter (sspifilt.dll) is located in C:\WINNT\system32\inetsrv\

Attempts to browse the same web pages via https fail (obviously). I
tried nearly everything. What is preventing sspifilt.dll to load itself?

Thanks in advance,
Theo

David
Thu Dec 09 19:59:13 CST 2004

1. Verify C:\WINNT\system32\inetsrv\sspifilt.dll exists
2. Failure to load the filter should be reported in the Event Log.
3. If you still get nothing, run:
cscript %systemdrive%\inetpub\adminscripts\adsutil.vbs enum
w3svc/filters/sspifilt

And report the value of the "Win32Error" property

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"Theo Kanter" <theo@verkstad.net> wrote in message
news:N%0ud.123886$dP1.440708@newsc.telia.net...
My Win2K professional (SP4) machine runs an IIS5.0 web server with
Frontpage2K extensions. Everything works OK except that I can't get SSL
to work. I installed a certificate following the MS guidelines. BUT:

The ISAPI tab via the web server properties in the IIS manager shows a
big fat red arrow pointing down. The priority is *Unknown*. The SSL
filter (sspifilt.dll) is located in C:\WINNT\system32\inetsrv\

Attempts to browse the same web pages via https fail (obviously). I
tried nearly everything. What is preventing sspifilt.dll to load itself?

Thanks in advance,
Theo

Theo
Fri Dec 10 03:34:31 CST 2004

Thank you David for the quick response.

The Event Viewer reported:
Event Type: Error
Event Source: W3SVC
Event Category: None
Event ID: 22
Date: 2004-12-09
Time: 20:17:58
User: N/A
Computer: PSI
Description:
An attempt was made to load filter
'C:\WINNT\system32\inetsrv\sspifilt.dll' on a server instance but it
requires the SF_NOTIFY_READ_RAW_DATA filter notification so it must be
loaded as a global filter.
For additional information specific to this message please visit the
Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp.

MSDN has a note about raw data filters regestering for this, but I am
not sure about the implications as IIS5.0 has only one place for
entering sspifilt.exe in management console (isapi filters tab)

The CScript command failed to display the object. However, the Metabase
editor reported the following on w3svc/filters/sspifilt:

KeyType Server String IlsFilter
Win32Error Server DWord 0
FilterPath Server String C:\WINNT\system32\inetsrv\sspifilt.dll
FilterState Server DWord 1
FilterFlags Server DWord 134792449
FilterDescription Server String IlsFilter Microsoft SSPI Encryption
Filter v1.0

regards
Theo



David Wang [Msft] wrote:
> 1. Verify C:\WINNT\system32\inetsrv\sspifilt.dll exists
> 2. Failure to load the filter should be reported in the Event Log.
> 3. If you still get nothing, run:
> cscript %systemdrive%\inetpub\adminscripts\adsutil.vbs enum
> w3svc/filters/sspifilt
>
> And report the value of the "Win32Error" property
>

Theo
Fri Dec 10 04:12:37 CST 2004

The command CScript command needed an extra slah to find the key and
returned the following:

C:\>cscript c:\Inetpub\AdminScripts\adsutil.vbs enum /w3svc/filters/sspifilt

Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

KeyType : (STRING) "IIsFilter"
FilterPath : (STRING)
"C:\WINNT\system32\inetsrv\sspifilt.d
ll"
FilterDescription : (STRING) "Microsoft SSPI Encryption
Filter, v1
.0"
FilterFlags : (INTEGER) 134792449
FilterState : (INTEGER) 1
NotifySecurePort : (BOOLEAN) True
NotifyNonSecurePort : (BOOLEAN) False
NotifyReadRawData : (BOOLEAN) True
NotifyPreProcHeaders : (BOOLEAN) True
NotifyAuthentication : (BOOLEAN) False
NotifyUrlMap : (BOOLEAN) False
NotifyAccessDenied : (BOOLEAN) False
NotifySendResponse : (BOOLEAN) False
NotifySendRawData : (BOOLEAN) True
NotifyLog : (BOOLEAN) False
NotifyEndOfRequest : (BOOLEAN) False
NotifyEndOfNetSession : (BOOLEAN) True
NotifyOrderHigh : (BOOLEAN) True
NotifyOrderMedium : (BOOLEAN) False
NotifyOrderLow : (BOOLEAN) False

C:\>

I am still puzzled what to do about the error event reporting that
SSPIFILT requires SF_NOTIFY_READ_RAW_DATA filter notifications and why
it occurs.

regards
Theo


Theo Kanter wrote:
> Thank you David for the quick response.
>
> The Event Viewer reported:
> Event Type: Error
> Event Source: W3SVC
> Event Category: None
> Event ID: 22
> Date: 2004-12-09
> Time: 20:17:58
> User: N/A
> Computer: PSI
> Description:
> An attempt was made to load filter
> 'C:\WINNT\system32\inetsrv\sspifilt.dll' on a server instance but it
> requires the SF_NOTIFY_READ_RAW_DATA filter notification so it must be
> loaded as a global filter.
> For additional information specific to this message please visit the
> Microsoft Online Support site located at:
> http://www.microsoft.com/contentredirect.asp.
>
> MSDN has a note about raw data filters regestering for this, but I am
> not sure about the implications as IIS5.0 has only one place for
> entering sspifilt.exe in management console (isapi filters tab)
>
> The CScript command failed to display the object. However, the Metabase
> editor reported the following on w3svc/filters/sspifilt:
>
> KeyType Server String IlsFilter
> Win32Error Server DWord 0
> FilterPath Server String C:\WINNT\system32\inetsrv\sspifilt.dll
> FilterState Server DWord 1
> FilterFlags Server DWord 134792449
> FilterDescription Server String IlsFilter Microsoft SSPI Encryption
> Filter v1.0
>
> regards
> Theo
>
>
>
> David Wang [Msft] wrote:
>
>>1. Verify C:\WINNT\system32\inetsrv\sspifilt.dll exists
>>2. Failure to load the filter should be reported in the Event Log.
>>3. If you still get nothing, run:
>>cscript %systemdrive%\inetpub\adminscripts\adsutil.vbs enum
>>w3svc/filters/sspifilt
>>
>>And report the value of the "Win32Error" property
>>

Theo
Sat Dec 11 01:53:03 CST 2004

The below is my input to the MS KB or other IIS 5.0 support forums:

The ISAPI tab via the web server properties in the IIS manager reports
sspifilt.dll as *not* loaded (see further error message details in other
responses to David's response in this thread).

Despite this I found that I am able to browse the web site with https
(SSL) on the *inside* the firewall. Turns out that the firewall blocks
port 443 to my server, which got me looking for a potential problem in
the first place.

As mentioned the ISAPI tab in the Web Site Properties (IIS Manager)
reported a problem loading sspifilt.exe. Then the event manager reported
an error that sspifilt.exe requires the SF_NOTIFY_READ_RAW_DATA filter
notification requiring the filter to be loaded as a *global* filter.

Thus, I started looking around what is meant by "global". When
inspecting the ISAPI tab of the "WWW Service Master Properties for
<host>", there are a number of filters properly loaded among which
sspifilt.dll (this time with a green arrow!), which explains why SSL
works (albeit inside the firewall).

The contradictory reports about the status of sspifilt.exe and where to
load sspifilt.exe via different property panels in the IIS 5.0 manager
is very confusing and I found no reference to this elsewhere or in the
MS KB. Instead I found many references of people who struggled with the
same problem.

--theo

Theo Kanter wrote:
> My Win2K professional (SP4) machine runs an IIS5.0 web server with
> Frontpage2K extensions. Everything works OK except that I can't get SSL
> to work. I installed a certificate following the MS guidelines. BUT:
>
> The ISAPI tab via the web server properties in the IIS manager shows a
> big fat red arrow pointing down. The priority is *Unknown*. The SSL
> filter (sspifilt.dll) is located in C:\WINNT\system32\inetsrv\
>
> Attempts to browse the same web pages via https fail (obviously). I
> tried nearly everything. What is preventing sspifilt.dll to load itself?
>
> Thanks in advance,
> Theo

David
Mon Dec 13 13:33:09 CST 2004

Your SSL inside the Firewall observation does not sounds like it has
anything to do with IIS. Inability to access port 443 when you when your
network traffic traverses a firewall that blocks the port is by-design
behavior.

Actually, SSL is very straight forward on IIS. Just install a server
certificate