I had a problem the other day trying to get Dynamics NAV 2015 to work with a wildcard certificate.While the server started ok, clients couldn’t connect and the error message at the end of this post appeared. The problem seem that you need to define the DnsIdentity on all clients, seems like the client application can’t recognize wildcard dns names automatically and you need to define it yourself. The down side of this is that all clients need to make this modification, while using normal certificates connect clients automatically. So if you do decide to go down this route be aware of this. The fixes are defined below.
To fix it on the client side:
modify the “C:\Users\username\AppData\Roaming\Microsoft\Microsoft Dynamics NAV\80\ClientUserSettings.config” to include the proper certificate name for DnsIdentity :
|
1
|
<add key="DnsIdentity" value="example.com"/>
|
To fix it on the Nav Server Web Instance:
you can modify the web.config of your Nav web instance for example “C:\inetpub\wwwroot\Mynav” to include the proper certificate name for DnsIdentity :
|
1
|
<add key="DnsIdentity" value="example.com"/>
|
You can also run the powershell command from Navs powershell:
|
1
|
New-NAVWebServerInstance -WebServerInstance Mynav -Server "test.example.com" -ServerInstance DynamicsNAV80_Instance
|
The error on the Nav Web Instance or Client:
|
1
2
3
4
5
6
7
|
"Error accessing Website Microsoft Dynamics NAV 2015 Web Client
Message: The client could not establish a connection to the Microsoft Dynamics NAV Server.
Reason = "Configuration setting 'DnsIdentity' has an invalid value"
Description = "Identity check failed for outgoing message. The expected DNS identity of the remote endpoint was 'test.example.com' but the remote endpoint
provided DNS claim 'example.com'. If this is a legitimate remote endpoint, you can fix the problem by explicitly specifying DNS identity 'example.com'
as the Identity property of EndpointAddress when creating channel proxy. ""
|
This is probably not an error but by design. I would say that you ALLWAYS have to use DnsIdentity – At least I am doing this on every single installation I am doing.
You might be right Palle, what i found odd was, if you use a normal certificate and the dns name (you use in your connection string) matches the certificate dns (common name) then leaving the DnsIdentity empty is ok and the client works but it can’t recognise a wild card and assumes the domain is supposed to be the top level part only.