Skip to main content
Click here if you are having trouble viewing this site
Older versions of Internet Explorer will not support certain site features. Chrome, Safari, Firefox, and Edge will provide the best experience.
Resources
Spok

Configuring SSL Certificates

  1. Last updated
  2. Save as PDF
This topic describes how to configure an existing SSL certificate which is set up for use with Spok Mobile.

For detailed information about how to set up SSL certificates for use with Spok Mobile, see the Spok Mobile Pre-Implementation Guide.

Applying the SSL Certificate to Spok Mobile

  1. Log in to the Spok Enterprise Administration interface by opening a browser and navigating to http://server/Web

  2. Navigate to Administration > System Configuration > Mobile.

  3. Enable the HTTPS option.

  4. Make sure the SSL Port is set to 8091.

  5. Select an SSL Certificate from the drop-down list.

  6. Click the Save button to save the information.

  7. Click the Apply button to apply the changes.

Spok Mobile will restart when you click the Apply button.

Binding Ports to the SSL Certificate

When a Spok Mobile customer installs a new certificate, they must bind the certificate to ports 443 and 8091.

You can bind to port 443 by using an IIS Administration MMC snap-in.

You can bind to port 8091 by doing the following:

  1. Add the new certificate to the server. For detailed information on how to do this, see the Spok Mobile Pre-Implementation Guide.

  2. In IIS Admin MMC, set up https bindings for “amc.customer.url” to include port 443. For detailed information on how to do this, refer to Microsoft’s technical documentation.

  3. Retrieve the certificate hash. You can find certificate hash in the certificate snap-in on MMC. To find it, do the following:

    1. Access the certificate snap-in on MMC. The Certificate dialog will appear. For detailed information on how to do this, refer to Microsoft’s technical documentation.

    2. In the Certificate dialog, click the Details tab.

    3. The certificate hash will appear in the lower part of the window.
      Mobile_4.4_SSL_Binding_001.png

    4. Before using the hash value, remove the spaces from it.

  4. Add the certificate binding to port 8091 with from a command line by running netsh. In the example below, replace XXXXXXXXX with the hash value without spaces. For example:
        netsh http add sslcert ipport=0.0.0.0:8091 certhash=XXXXXXXXX  appid={00000000-0000-0000-0000-000000000000}

Testing the SSL Certificate

  1. Open a web browser and navigate to https://SERVER:8091/

  2. If the SSL certificate is valid, a web page with "Service" in the title bar will display. The page should indicate that it is a "Windows Communication Foundation service."

Fixing Ports Bound to Expired Certificates

Both port 443 and 8091 must be bound to the same certificate hash, and the certificate cannot be expired. If either of these ports are bound to an expired certificate, you may receive notifications, but no messages for those notifications. To diagnose and fix this issue, do the following:

  1. In a command prompt with administrator priveleges, run netsh http show sslcert to view the bindings for ports 443 and 8091. Remember the Certificate Hash to which each port is bound.
  2. Access IIS Manager to view the certificate's Expiration Date and Certificate Hash.
  3. Compare the Certificate Hash values given in IIS and the port details to ensure that the certificate to which each port is bound is not expired.
  4. If either port is bound to an expired certificate, navigate to the Default Web Site in IIS.
  5. In the Actions menu, under Edit Site, click Bindings...
  6. Add or remove port 443 or 8091 as appropriate.

You can also add and delete bindings from the command line using the netsh http delete and netsh http add commands. For example:

netsh http delete sslcert ipport=0.0.0.0:8091

netsh http add sslcert ipport=0.0.0.0:8091 certhash=certificate hash value

Fixing Incomplete Port Bindings 

When renewing a certificate, occasionally only port 443 will be bound to the new certificate. Ensure that both port 443 and 8091 are bound to the new certificate. If both are not bound, Spok Mobile will not function. To re-bind port 8091 and resolve this issue, launch PowerShell as an administrator and do run the following:

First, confirm that the certificate is not expired.Run netsh http show sslcert to display the binding for port 443.

  1. Copy the certificate hash and appid for port 443.
  2. Run netsh http delete sslcert ipport=0.0.0.0:8091
  3. Run netsh http add sslcert ipport=0.0.0.0:8091 certhash=paste copied hash here appid='paste copied appid here'
  4. After the certificates have been bound, restart either the Spok Mobile server or IIS.
    1. To reset IIS, run iisreset in PowerShell.