How can I setup HTTPS with Secure Sockets Layer (SSL) for Team Foundation Server?
Setting up HTTPS with Secure Sockets Layer (SSL) for Team Foundation Server
Visual Studio 2015
You can strengthen the security of your deployment of Visual Studio Team Foundation Server (TFS) by configuring it to use Hypertext Transfer Protocol Secure (HTTPS) with Secure Sockets Layer (SSL). You can choose either to require this protocol, which maximizes the security of your deployment, or you can choose to support HTTPS with SSL in addition to the default protocol, HTTP. If you use Release Management for Visual Studio, you can also configure that to use HTTPS with SSL, although you cannot configure it to support both HTTP and HTTPS with SSL.
Before you choose a configuration, review the advantages and disadvantages described here. After you identify the configuration that best meets the security needs of your organization, follow the steps in this topic to configure your deployment.
In this topic
If you configure your deployment of TFS to support both protocols, users whose computers have been configured for HTTPS with SSL will connect by using that protocol, which makes your deployment more secure. In addition, users whose computers are configured for HTTP only can still connect to your deployment. Although you should not deploy this configuration over public networks, you can gain the following advantages by continuing to support HTTP connections in a controlled network environment:
You can increase the security of your deployment over time by configuring client computers for HTTPS with SSL as your schedule permits. If you take a phased approach, you do not need to upgrade all computers at the same time, and users whose computers have not yet been upgraded can still connect to the deployment.
You can more easily configure and maintain Team Foundation Server.
Calls from one Web service to another are faster over HTTP than over HTTPS with SSL. Therefore, you can continue to support HTTP connections from client computers for which the performance requirements outweigh the security risks.
Before you configure TFS to support or require HTTPS with SSL, you should consider the following disadvantages:
You might complicate ongoing administration tasks. For example, you might have to reconfigure your deployment to stop supporting HTTPS with SSL before you can apply service packs or other updates.
You must not only configure but also manage a certification authority (CA) and certificate trusts. You can use Certificate Services in Windows Server 2003 and Windows Server 2008, but you might not want to invest the time and resources that deploying a secure public key infrastructure (PKI) requires.
You must spend significant time setting up and testing either of these configurations, and troubleshooting your deployment will become more difficult.
If you continue to support both protocols, external connections might not be encrypted if the application tier for Team Foundation is not appropriately secured.
If you require HTTPS with SSL, your deployment's performance will be slower.
The procedures in this topic describe one process for requesting, issuing, and assigning certificates that are required for SSL connections in TFS. If you are using different software than what this topic describes, you might need to perform different steps. To support external connections to your TFS deployment, you must also enable Basic authentication, Digest authentication, or both in Internet Information Services (IIS).
By following the procedures in this topic, you will accomplish the following tasks:
Obtain certificates for your deployment of Team Foundation Server and the websites that it uses.
To perform the procedures in this topic, you must first meet the following requirements:
The logical components in the data and application tiers of Team Foundation must be installed, although in the case of TFS itself, not necessarily configured. These tiers include IIS, SQL Server, and any additional components you might have integrated, such as SharePoint Products, Team Foundation Build, Release Management and SQL Server Reporting Services.
The procedures in this topic refer to the server or servers that are running the logical components in the application tier for Team Foundation and the data tier for Team Foundation. The application and data tiers might be running on the same server or multiple servers, as described in Team Foundation Server install guide.
You must have a certification authority (CA) from which you can issue certificates, or have subscribed to a third-party certifying authority with a trusted chain. This topic assumes that you are using Certificate Services as your CA, but you can use any CA that you have configured for your deployment, or certificates from a trusted third-party certification authority. If you do not have a certification authority, you can install Certificate Services and configure one. For more information, see the one of the following sets of documentation on the Microsoft website:
You need to be an administrator to configure all the components of your deployment for HTTPS and SSL. If you work in a distributed deployment where different people have administrative permissions for individual components, such as SharePoint, you'll need to coordinate with those people to complete configuration.
Specifically, you must belong to the Team Foundation Administrators group, and you must belong to the Administrators group on the application-tier, data-tier, and TFS Proxy server or servers for Team Foundation.
To configure a build server, you must belong to the Administrators group on that server.
To configure Release Management, you must belong to the Administrators group on the server that hosts Release Management Server and be a member of the Release Manager role in Release Management.
If your deployment uses SharePoint Products, you must belong to the Administrators group on the server that hosts SharePoint Central Administration. You must also belong to the Farm Administrators group.
If your deployment uses reporting, you must be a member of an administrative security group or have equivalent permissions individually set for configuring reporting services.
For more information, see Permission reference for Team Foundation Server.
Before you configure TFS to use HTTPS with SSL, you must obtain and install a server certificate for the servers in your deployment. To obtain a server certificate, you must install and configure your own certification authority, or you must use a certification authority from an external organization that you trust (third-party certificates).
For more information about how to install a certification authority, see the following topics on the Microsoft website:
After you enlist in a certification authority, you must either request a certificate by using IIS Manager, or you must manually install the certificate on each of the following servers in your deployment:
Each application-tier server.
Each server that is running Team Foundation Server Proxy, if any are configured for your deployment.
Each server that is running Team Foundation Build Service as either a build controller or a build agent, if any are configured for your deployment.
Each server that is running Release Management Server, or any servers¹ in a release environment that are running the deployment agent, if Release Management is part of your deployment.
Each server that is running SharePoint Products, if SharePoint Products is configured for your deployment.
The server that is running Reporting Services, if one is configured for your deployment.
In addition, the client computers in your deployment will need to be enrolled in the certificate chain and request the needed certificate. If you’re using Release Management, this includes any computers running the Release Management client, as well as any clients¹ running the deployment agent in your release environments. If one or more of your projects uses Git for version control, users in those projects will also have to configure Git on their computers to recognize and use the client certificate. For information about how to request a client certificate from a specific CA, see the documentation for that certification authority.
¹ Clients and servers are called out separately here, but that’s just a convention of this document. Any computer running the deployment agent needs the certificate installed.
Now you need to configure each website that will require this certificate with the appropriate settings, (with the exception of the Release Management website, which you will configure later). Specifically, you'll need to do this for each of the following websites:
Team Foundation Server
Microsoft Team Foundation Server Proxy (if your deployment uses it)
SharePoint Central Administration (if your deployment uses SharePoint)
On each server that hosts a website that you want to configure, open Internet Information Services (IIS) Manager.
Expand ComputerName, expand Sites, open the submenu for the website that you want to configure (for example, Team Foundation Server), and then choose Bindings from the Actions pane.
In Site Bindings, choose Add.
The Add Site Binding dialog box appears.
In the Type list, choose https.
In Port, type a different port number.
The default port number for SSL connections is 443, but you must assign a unique port number for each of the following sites: Default Website, Team Foundation Server, Microsoft Team Foundation Server Proxy (if your deployment uses it), and SharePoint Central Administration (if your deployment uses SharePoint).
You should record the SSL port number for each website that you configure. You will need to specify these numbers in the administration console for Team Foundation.
In SSL Certificate, choose the certificate that you imported, and then choose OK and close the Bindings page.
On the Home page for the website that you are configuring, open the Features view.
Under IIS, choose Authentication.
Choose an authentication method that you want to configure, open its submenu, and then enable, disable, or perform additional configuration on the method, as best meets your security needs. For example, if you wanted to disable anonymous authentication, you would choose the Anonymous Authentication method and the choose Disable from the Actions menu.
Once you have finished configuration, restart web services.
You must configure your firewall to allow traffic through the SSL ports that you just specified in IIS. For more information, see the documentation for your firewall.
Make sure to test traffic on the ports you specified from another computer. If you cannot access the default website or Team Web Access, double-check the port settings you specified for these websites in IIS, and make sure that the firewall is configured appropriately to allow traffic on those ports.
If your deployment uses reporting, you must configure SQL Server Reporting Services to support HTTPS with SSL and to use the port that you specified in IIS for Team Foundation Server. Otherwise, the report server will not function correctly for your deployment. For more information, see Configuring a Report Server for Secure Sockets Layer (SSL) Connections.
If your deployment does not use reporting, you can skip this procedure.
Follow these steps to configure your TFS deployment with the HTTPS ports and values that you configured in IIS for the default and Team Foundation Server websites.
To reconfigure Team Foundation Server to use or require HTTPS
Open the administration console for Team Foundation and browse to the application tier node.
In Application Tier Summary, choose Change URLs.
The Change URLs window opens.
In Notification URL, type the HTTPS URL that you configured for the Team Foundation Server website in IIS.
For example, you might have configured the website to use port 444. In this case, you type https://ServerName:444/tfs. Make sure that you use the fully qualified domain name of the server instead of localhost.
Choose Test. Don't choose OK if the test doesn't pass. Go back and make sure that you entered the correct URL and port information, that all firewalls are configured to allow traffic on those ports, and that the site is available and running in IIS Manager.
To require HTTPS, choose Use in Server URL, and then type the HTTPS URL that you configured for the Team Foundation Server website.
Make sure that you use the fully qualified domain name of the server instead of localhost.
Choose Test, and then choose OK if the test passes.
If your deployment uses SharePoint Products, choose SharePoint Web Applications in the administration console. Otherwise, skip the next six steps.
In SharePoint Web Applications, in the Name list, choose a web application, and then choose Change.
The SharePoint Web Application Settings page opens.
In Web Application URL, change the URL to the HTTPS value for the application.
In Central Administration URL, change the URL to the HTTPS value for the Central Administration website.
(Optional) In Friendly Name, change the value to reflect the HTTPS address of this application.
Repeat the previous five steps for every SharePoint web application in your deployment.
If your deployment uses Reporting Services, in the administration console, choose Reporting. Otherwise, skip the rest of this procedure.
In Reporting, choose Edit.
If the Take Offline dialog box opens, choose OK.
The Reporting window opens.
Choose the Reports tab. In URLs for Report Server, type the HTTPS URLs for Web Service and Report Manager, and then choose OK.