Reporting Services 2008 and SSL

A while back when I started using a preconfigured server with Windows Server 2008 and SQL Server 2008 I came across the following.

My reports were deployed to the server, they were working fine when using Internet Explorer directly on the server.  But when I tried to connect remotely to the Report Manager (http://server.domain/Reports) I got the well-known “Page cannot be displayed” message.  Then I tried the Report Server (http://server.domain/ReportServer) and that seemed to work fine.  Until I asked it to generate a report, same issue.

I then logged on to the server to have a look if anything was appearing in the SSRS-related log files.  I saw the GET requests with the ListChildren command from Report Server getting logged in the HTTP log, but no Render command.  Other log files didn’t show anything for the report render requests and neither did the ExecutionLog2 view in the ReportServer database.  Which is quite logical of course, if there’s no GET request, there’s no execution either.  But hey, I was exploring all options here.

Then I activated HttpWatch to have a look at what was happening with the GET request.  And guess what!  It was being redirected to HTTPS!  So the report server apparently did not accept remote unencrypted connections, it forced the user into HTTPS.  But that didn’t work either, probably because no one properly configured SSL.

In my situation there’s no need for the encrypted connection so I started looking for the switch to turn off SSL.  I had a look in the Reporting Services Configuration Manager, no checkbox that says “do not redirect to SSL” or similar.  Nothing in the Report Server properties either.

Apparently the only way to turn SSL off (or on for that matter) is by changing a setting in the RSReportServer.config file.  This setting is called SecureConnectionLevel and valid values are:

0 Least secure. The report server does not check for a secure connection when Web service methods are invoked. However, all calls to the Web service can still be made to the report server over a secure connection.
1 Minimally secure. All Web service calls that are made over an insecure connection and which might pass sensitive data such as user credentials are rejected. However, this setting does not guarantee security. It is still possible for sensitive data sent by the client to the report server to be exposed before the report server handles the request and rejects it.
2 Secure. All rendered reports and all Web service calls require a secure connection. This includes all calls to the Render method and requests for rendered reports made through URL access.
3 Most secure. All calls made to the Reporting Services SOAP API require a secure connection.

The descriptions in the table above are copied from the Using Secure Web Service Methods article, see there for more details.

In my situation the setting was set to 2.  Changing it to 0 solved my issue.  This also explains why the Report Server was partly working.  When the security level is set to 2, all calls to Render and other web service methods need to be secure while listing the children can be done unencrypted.

In case you’re interested in actually using SSL, have a look at the Configuring a Report Server for Secure Sockets Layer (SSL) Connections article.

I noticed that my blog item contains links to almost all relevant MSDN BOL pages related to Reporting Services configuration, interesting to keep in mind :-)

Share

Tags: , ,

  1. Les Williams’s avatar

    Thank you very much. This had exactly what I needed to know. And many thanks for including links to BOL so I could review the Microsoft documentation.

    Reply

  2. PV’s avatar

    Thanks for sharing. Saved me some time!

    Reply

  3. Greg’s avatar

    I’ve banged my head against the wall for a few weeks now trying to properly configure SSRS 2008 to work over an SSL connection and I’ve come to the conclusion that it is broken. I believe that despite the fact Microsoft made SSRS very “webby” it was was intended to accessed outside of the local network and over the web.

    Most features in the report builder don’t work at all without a direct connection to the database/data source!!! I was hoping that this could be a step towards ad-hoc reporting for some users outside of my firewall but I’m quickly finding out that is not the case. :-(

    I’ve read a little bit about SQL Server 2008 R2 and there appears to be some promising new things that are moving towards this goal but we’ll have to wait until May 2010 to find out for sure.

    Reply

  4. VjReddy’s avatar

    Thankz alot for giving such precious information,i was searching for the exact problem since long.keep on posting for new things.

    Reply

    1. Valentino Vranken’s avatar

      I’m glad I could help you out, will keep on posting :-)

      Reply

  5. Drobinson’s avatar

    Thx – Just the info I needed.

    Reply

  6. lucyht’s avatar

    Just what I needed thanks, can’t believe it is not configurable through SSRS Configuration Manager

    Reply

  7. adnan’s avatar

    great help, thanks

    Reply

  8. DNA’s avatar

    It’s great! thanks

    Reply

  9. Yingto’s avatar

    Thanks so much. Just the information I need.

    Reply

  10. mani’s avatar

    You are a rockstar. Just what i needed.

    Reply

© 2008-2014 BI: Beer Intelligence? All Rights Reserved