If you’re trying to put an application served on IIS (Sharepoint, ADFS Proxy) behind a Reverse Proxy you’ll often encounter issues with SSL Bridging. While the clientside connection works fine, the serverside connection gets a TCP RST from the back-end after SSL ClientHello.
This is a common issue, and typically caused by improper or missing SNI configuration. IIS by default doesn’t offer any “fallback” page and will reset the connection if not using SNI.
Below you can find examples of how to fix this error on common Reverse Proxies.
Add to your backend configuration:
server sharepoint ssl sni str(sharepoint.company.com)
Add to your VirtualHost configuration if your hostname matches the one your clients will be using:
If the hostname differs:
If hostname matches the server name:
If it doesn’t match:
F5 BIG-IP LTM
Create a new Server SSL profile under Local Traffic > Profiles > Server SSL and fill in the “Server Name” field. Apply this to the Server SSL profiles on your Virtual Server.
Leave a Reply