Here at ScreenConnect HQ we've been working on a little script to automate functions that we couldn't normally add to a web-based program. All you need to do is run the .exe for the script.

Requirements:
-Windows Server 2008 r2 and later
-ScreenConnect installed

Before you get started:
-Read our SSL documentation
-Back up your web.config file
-Run the script as an administrator


Download the ScreenConnect SSL Configurator


*Last updated 10/13/15

Edited by user Tuesday, October 13, 2015 2:40:14 PM(UTC)  | Reason: Script has been moved to http://help.screenconnect.com

The problem with a self-signed cert is that you have to make the client browsers trust it; otherwise ClickOnce deployment will likely fail. As long as you get a browser security warning, ClickOnce is going to have a problem deploying the client.

Is it just me or are the above links broken? All I get is a warning "Please do not link directly to this resource. You must have a session in the forum."

All data passing between host and guest systems is fully encrypted and protected from unauthorized access. This includes all screen data, file transfers, key strokes, and chat messages. ScreenConnect employs a 256 bit AES encryption algorithm, similar to that used by many banking and government institutions.

Although ScreenConnect encrypts all Relay session traffic by default, the Web Server HTTP traffic is not encrypted unless configured with SSL. There's really not a way to SSL/secure just the Login process without securing the entire website. Though this is something that we are looking into.

Edited by moderator Tuesday, May 21, 2013 12:40:51 PM(UTC)  | Reason: Not specified

Script has been updated!

I have a question which I have been unable to find the answer to in the various posts on the topic including this. It seems that once the SSL cert has been created and bound and the webconfig has been altered to have the webserver listen on port 443 then the relay cannot also run on port 443? Is this correct and if so what is the recommended solution? After following the procedure I seem to only be able to get either the relay service which I had previously changed in the webconfig to port 443 or the webserver service to run once it is changed from 80 which I had previously edited to be to 443 via the configurator. I understand that the relay is encrypted and for internal use I was fine with leaving the webserver on 80 and relay on 443 but for potential meetings with clients, etc. many would be hesitant to go to a site not using SSL so I wanted to change it to avoid this potential issue.

Thanks in advance for the heads up.

We are using StartSSL for secondary SSL certificates, etc. However, this tool uses MD5 hashes for generating the CSR, and StartSSL only will support SHA1 or better.

Can this be modified with the current tool using a command line argument? I have a trial account right now, but am uncomfortable with non-SSL for technicians logging into the product with their AD accounts.

UPDATE 2/25/2014: What I did was utilize our Certificate Authority's SSL Generation tool to generate both a Private key and a Public key for our domain. After that, I found a thread about how to secure both the "Web Interface" and the "Relay" services. See more here

Edited by user Tuesday, February 25, 2014 10:36:54 PM(UTC)  | Reason: Adding link to forum post for my resolution method.

Downloaded latest version of SC (v4.2), and running on Ubuntu Server 12.04.

Generated an external CA validated certificate, by using the ScreenConnect SSL Configurator.

I've extracted the tarball, but there is no httplistener directory to extract the certificate and private key into. The path only contains "certs" or "keypairs". I've tried installing it using:



Still no joy. I just get "SSL connection error" in Chrome.

Any ideas? Has the process changed from SC v4.1 to v4.2?

Hey there. I have the same issue. Firstly there was no httplistener directory so I created it - copying the 443.pvk and 443.

I made the changes to the web.config file as suggested.

I navigated to the httplistener directory then ran -

httpcfg -add -port 443 -pvk 443.pvk -cert 443.cert

This seemed to go off without a hitch. When I use the httpcfg -list command it gives me the thumbprint on the port.

When I navigate to the site using https however it just comes back with SSL Connection Error - as if it doesnt even know there is a certificate registered.

When I go to my site with :443 --- it works --- but using HTTPS gives SSL Connection Error. So 443 is open - just not secured.

Shouldnt I have to register the certificate locations somewhere in the configs?????

Please excuse my bluntness - I am used to working with Apache2 and Mono is a little strange for me.

pcheroes, we might need to get a session going to get a closer look. Please email us at support@screenconnect.com and reference this forum post.

Thank you