Now that we have support for different types of SSL certificates in FileMaker Server 15, and we have more intuitive tools to generate the ‘Certificate Signing Request’ to get the certificate generated and then imported and installed on FileMaker Server; the threshold for getting one and properly securing your data is getting lower.
A common problem though that you may run into is this one:
What is happening here? I have my FileMaker Server properly protected with a certificate that matches in name. Why then is FileMaker Pro complaining that it can not trust my server?
Note that the name that FileMaker Pro is using is not actually the Fully Qualified Domain Name (FQDN) of my server, but rather an abbreviation of it that ends in “.local”.
That’s because Bonjour is in play here. Bonjour – as you know – allows for easy discovery of devices on your network. But in this case it is working against us by generating an SSL challenge.
In the FileMaker Pro (or FileMaker Go) ‘Open Remote’ dialog I can see my server listed under the ‘Local servers’. That’s bonjour; that’s what is making them show up here. And you’ll note that the server is listed with the proper name that is on the SSL certificate.
However when you try to open one of its files you will get the SSL challenge that states that “.local” can not be verified.
Obviously you can choose to trust the server after inspecting the certificate by toggling the ‘Always permit connection to this host’. But that will not get you the proper encryption state that you are after. FileMaker will not give a ‘green lock’ and Get( ConnectionState ) will be 2. As per the FileMaker Help: “2 = for a secured connection (SSL) when the server name doesn’t match the certificate”.
So how to get around this? Bonjour is an optional component of FileMaker Server but it is very much the default installation path to have it included. How do you get rid of it without having to uninstall and reinstall FileMaker Server?
For that we turn to our FileMaker Server. You will need to stop the FileMaker Server service in the Windows control panel so you will need to plan on doing this when nobody is connected to your hosted files.
- Open a Command prompt and type in
SC query “FileMaker Server”
- It should tell you that the service is stopped as shown in Figure 5.
Next we are going to delete the service entry:
- Type in:
SC delete “FileMaker Server”
- and wait for the confirmation. See Figure 6.
Now this sounds a lot more scary that it really is. The service that we see in the Windows Services control panel is basically just a wrapper that we can easily recreate. So let’s do that by typing in:
SC create "FileMaker Server" displayname= "FileMaker Server" binpath= "C:Program FilesFileMakerFileMaker ServerDatabase serverfmshelper.exe" type= own start= auto
and wait for the confirmation. See Figure 7.
In the Services control panel you can bring up the properties for the services and confirm on the “Dependencies” tab that there are none. See Figure 8.
As the final step; stop the Bonjour service.
When you now go back to your FileMaker Pro or FileMaker Go you will notice that the server is no longer listed in the local hosts. In order to get to it you will now have to add it as a favorite host. And you need to do that using the same Fully Qualified Domain Name (FQDN) that is on the SSL certificate. Once you do that you will not get an SSL challenge and you will get both a green lock (see Figure 9) and Get( ConnectionState) will be 3 ‘for a secured connection with a fully verified server name in the certificate.’
You can of course use a launcher file or the FMP URL protocol or even a snapshot link to give to your users so that they can easily open your solution. Just make sure that you make your initial link using that same FQDN as is on your SSL certificate. Do not use an IP address for instance or you will be back to getting SSL challenges and black locks.
If at some point you want to have the Bonjour functionality back, follow the same steps but use this command line when you recreate the service to add the bonjour dependency back in:
SC create "FileMaker Server” displayname= “FileMaker Server” binpath= “C:\Program Files\FileMaker\FileMaker Server\Database server\fmshelper.exe” type= own start= auto depend="Bonjour Service"