Installing Drupal 9 on Windows 10

 1. Setup Database on MySQL 

# create database

CREATE DATABASE db_name;

CREATE DATABASE db_name DEFAULT CHARACTER SET utf8 COLLATE utf8_unicode_ci;

SHOW DATABASES;

GRANT ALL ON db_name.* TO 'user_name'@'localhost' IDENTIFIED BY 'userpass_name';

SELECT user FROM mysql. user;

FLUSH PRIVILEGES;

EXIT;

2. Download and Extract Drupal 9

3. Add Entry in IIS 

4. Navigate to URL

ISSUES

Issue:.IIS Handler Mapping Error: 

There was an error while performing this operation" web.config
Filename: \\?\C:\Inetpub\wwwroot\<folder>\web.config

Details:

It turned out the website was using URL rewrite module which i was missing.

Downloaded web platform installer from MS and installed URL rewrite module.

http://www.microsoft.com/web/downloads/platform.aspx

Wish IIS errors were more informative than just "There was an error..."

Resolution:

install URL Rewrite 

Issue: PHP EXTENSIONS Disabled gd windows 10 IIS

Resolution:

In order to enable GD Library support for PHP on Windows server, follow the below mentioned steps:

First of all, make sure that php_gd2.dll file is present into the directory identified as extension directory in PHP folder.

If the above file is not present, then you need to download it from http://php.net/ and copy in the extension directory of PHP folder.

If the file is already present, then you need to enable php_gd2.dll extension from php.ini configuration file.

You can verify extension-dir through PHPINFO page. Following is the code for PHPINFO Page:

<?php

phpinfo();

?>

After performing all these steps, restart the IIS web server.

Issue: Upgrade MySQL from 5.x to 8.x

Resolution:

https://dev.mysql.com/get/Downloads/MySQLInstaller/mysql-installer-community-8.0.19.0.msi

https://www.sqlshack.com/how-to-install-mysql-database-server-8-0-19-on-windows-10/

cd "C:\Program Files\MySQL\MySQL Server 5.5\bin"

#Backup the databases

mysqldump --lock-all-tables -u root -p --all-databases > dump.sql

#Stop the service and Uninstall

SC STOP MySQL

"C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqladmin" -u root shutdown

Issue: OPcache disabled

Resolution:

OPcache can only be compiled as a shared extension. If you have disabled the building of default extensions with --disable-all, you must compile PHP with the --enable-opcache option for OPcache to be available.

Once compiled, you can use the zend_extension configuration directive to load the OPcache extension into PHP. This can be done with zend_extension=/full/path/to/opcache.so on non-Windows platforms, and zend_extension=C:\path\to\php_opcache.dll on Windows.

Note:

If you want to use OPcache with » Xdebug, you must load OPcache before Xdebug.

Recommended php.ini settings ¶

The following settings are generally recommended as providing good performance:

opcache.memory_consumption=128

opcache.interned_strings_buffer=8

opcache.max_accelerated_files=4000

opcache.revalidate_freq=60

opcache.fast_shutdown=1

opcache.enable_cli=1

Redirect from HTTP to HTTPS using the IIS URL Rewrite module

A production deployment of SharePoint 2013 or 2016 should ensure that all HTTP traffic is encrypted in transit, however many users will still type http:// in their browser or have links that point to http:// instead of  https://. In these cases it can beneficial to automatically redirect users to the proper URL. One way of accomplishing this is the URL Rewrite module for IIS.

Key Terms

Rewrite - Modifies the incoming URL, the outgoing URL, or both.

Redirection - Uses HTTP status codes such as 301 or 302 to redirect the client to a different location. This involves an additional client round trip.

Supportability for SharePoint

The support for redirects and rewrites with SharePoint is documented in KB2818415. Since a HTTP 301/302 redirect to inform the browser of the updated URL is the preferred option for SharePoint, that will be the focus of this post. Please note that 301/302 redirects may not work with Office client applications.

Uses for redirect

In most cases a redirect is used for one of two reasons:

1. Redirecting the user from http to https to enforce SSL communication. When a SharePoint farm is load balanced this is typically done using the load balancer but it some cases can be done on the SharePoint server or another server running IIS by using the IIS URL Rewrite module
2. Redirecting a user who has a stale URL, typically when the name is changed during a farm migration or upgrade. This can also be done using a load balancer or any IIS server by implementing the URL Rewrite module.

Step by Step Instructions for HTTP to HTTPS redirect

#1 Download the URL Rewrite tool by following the instructions here

#2 Ensure that the IIS site you are using is configured for the proper port 80 binding. In this case we are listening for all traffic on port 80. But you could restrict this based on host header as needed

#3 Create a new URL rewrite rule

#4 Configure Rule Settings Exactly as follows

Note: In this example {HTTPS}, {HTTP_HOST}, and {REQUEST_URI} are all URL parts that can be accessed using the URL Rewrite module. More information on URL parts can be found here.

#5 Apply the rule

#6 From the top node disable and enable the rule (alternatively perform IISReset)

Note: web.config file modifications

The URL rewrite rules get written to the web.config file for the site you are working in. For example, the above configuration should result in this addition to the web.config file:

1 2 3 4 5 6 7 8 9 10 11

name="Redirect to http" enabled="true" patternSyntax="Wildcard" stopProcessing="true"> url="*" negate="false" /> logicalGrouping="MatchAny"> input="{HTTPS}" pattern="off" /> type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" redirectType="Found" />

Additional Resources

Creating Rewrite Rules for the URL Rewrite Modulehttp://www.iis.net/learn/extensions/url-rewrite-module/creating-rewrite-rules-for-the-url-rewrite-module

Supportability of Rewrite and Redirects with SharePoint 2007/2010/2013http://support.microsoft.com/kb/2818415

Mixed Http and Https Content with SharePoint 2010http://blogs.visigo.com/chriscoulson/mixed-http-and-https-content-with-sharepoint-2010/

URL Rewrite for IIS7 http to https redirectionhttp://tech.mikeal.com/blog1.php/url-rewrite-for-iis7-http-to-https-redirection

URL Component Referencehttp://www.iis.net/learn/extensions/url-rewrite-module/url-rewrite-module-configuration-reference#Accessing_URL_Parts_from_a_Rewrite_Rule

Tags redirect; http; https; SSL

Setting up FTP on IIS

---

Issues

I'm a month too late to the party, but I just had the same problem and have a resolution for you.

First problem:

530 Valid hostname is expected.

IIS is a royal pain in the ass.

When you apply a binding to the FTP site you must also specify it in the ftp client when you login. So if your binding was configured as ftp.carsgozoom.com then your login should be ftp.carsgozoom.com|administrator.

Second problem:

530 User cannot log in, home directory inaccessible.

IIS is still a pain in the ass.

You're logged in but it doesn't know where to go. Well, it does know where to go but the directory doesn't exist. In your FTP root create a directory called LocalUser and put your username in there (FTProot/LocalUser/Administrator).

I hope this helps someone.

Bind multiple sites on same IP address and Port in SSL

Until IIS 7.5, the major limitation of IIS is that IIS will allow you to bind only one site for one IP: Port combination using an SSL certificate.  If you try to bind a second site on the IP address to the same certificate, IIS will give you an error when starting the site up stating that there is a conflict. In order to assign a certificate to be used by multiple IIS sites on the same IP address and port, we need to use a special mechanism. Before we go there let’s understand why it is not possible for IIS to allow the binding of multiple sites on same IP: Port combination using an SSL certificate.

Classic Chicken and Egg Problem

We know that IIS identifies a site using three piece of data:

1. IP-Address

2. Port

3. Host Header

You can have multiple HTTP site configured with different combination of above. The binding, for example 192.168.1.0:80 can be configured to site “MyServer1.com”. That means if I browse to IP-address 192.168.1.0 over port 80 then I will hit the site “MyServer1.com”. I can have the binding as 192.168.1.0:80:myserver2.com configured for site “MyServer2.com”. That means when I browse the site over IP-address 192.168.1.0 over port 80 with a host header as “myserver2.com” then I will hit the site MyServer2.com. This allows multiple DNS hostnames on a single server at the same IP address.

However this doesn’t work in HTTPS. To know why it doesn’t work in HTTPS lets understand the SSL handshake briefly.

1. Client – > (SSL Handshake) – > “ Hello, I support XYZ algorithm for encryption”

2. Server -> (SSL Handshake) -> “Hi there, Okay so here is my public certificate. Let’s use algorithm X”

3. Client -> (SSL Handshake)-> “Great we can use that”

4. Client -> (In Encrypted format)-> “HTTP Request”

5. Server -> (In Encrypted format)-> “HTTP Response”

Now let’s say hypothetically, you have set two sites on same IP-address and port and different host headers and you set two different certificates on both of them.

Look at the steps in SSL Handshake, Client sends the HTTP Request only in Step 4. That means Server doesn’t know what host header HTTP request is referring to until step 4. So at Step 2, Server has only IP-Address and Port information with it, so how can server figure out which certificate it needs to send to the Client as you have bind two certificates to same IP-Address and port.

When a request comes to HTTP.SYS layer, the HTTP.SYS reads the site configuration, including the certificate used to encrypt/decrypt the data. The host name is encrypted in SSL Blob that the client sends. However, IIS needs to know the host name in order to get the right certificate. Without the host name IIS cannot get to the correct site. As IIS is not able to get to the correct site so it cannot get the right certificate to decrypt the SSL blob to get the host name. This is the classic Chicken and Egg problem. We are turning into circles with no way out.

This is the precise reason; HTTP server can only allow one site per IP-Address: Port combination for HTTPS browsing. If you need to bind another site over HTTPS then you need to get either a different IP-Address or bind the site to a different port.

Sometimes getting a new IP-Address or port for each website becomes costly affair. So how we can attach two website to HTTPS over same IP: Port. There are two ways to do it in IIS7.

Wild Card Certificate.

A wildcard certificate can secure an unlimited number of first level sub domains on a single domain name. For example, you can get a certificate which is issued to *.mydomain.com. This certificate will secure www.mydomain.com, secure.mydomain.com, welcome.mydomain.com etc. Basically it will work on any subdomain that replaces the wildcard character (*).

Setting up the Wild Card Certificate

Step 1: Install the wildcard certificate.

Verify if the certificate is properly installed.

1. Select Start –> Run

2. Type in “MMC” and hit enter

3. From the console, select File –> Add / Remove Snap-in

4. Select Certificates from the Add / Remove dialog

5. Select Computer Account when prompt for which certificates the snap-in will manager.

6. Select Local Computer when prompted

7. Click OK to add the Snap-in to the MMC

8. Locate your SSL certificate

9. Right click on the certificate and select properties

10. You should see the * in the friendly name.

Once you have installed the certificate then the issued to should be the *.mydomain.com

Step 2: Setup the wildcard certificate in IIS

Let’s say you need following configuration

So let’s say you have the following configuration:

Website                   Host Header Value                  IP Address      Port             SSL Port 
================================================================== 
Test1                         www.myserver.com              10.0.1.1              80                  443 
Test2                        test2.myserver.com               10.0.1.1              80                  443

Test3                        test3.myserver.com                10.0.1.1             80                  443

IIS6

You need to select the certificate for all the three sites which are configured for same IP-Address and port.

To know how to bind the certificates in IIS6 please follow the following link

http://blogs.iis.net/robert_mcmurray/archive/2011/02/17/iis-6-setting-up-ssl-part-3-installing-the-certificate.aspx

After you installed the Certificate on all the websites with same IP address and port and you try to browse the sites. You will see that all of the HTTPS responses come from one specific site.

That means if you try to access https://test1.myserver.com, https://test2.myserver.com or https://test3.myserver.com you will get the response from one site only.

You won’t get the corresponding pages from different Websites depending upon the site in URL. Why? Because of the chicken and Egg problem remember. When the request comes to HTTP.SYS layer then Schannel will be able to decrypt the request but after decrypting the request it doesn’t know which site it needs to send the request as all the sites listening to same IP-Address and port.

You will also see that only one of the Websites will be running. Other Websites will be in stopped state because we cannot have multiple Websites running with same IP and same SSL port binding. If you try to start the other Websites you may see something like this below:

How to resolve above issue

To resolve this issue we need to add host headers to the sites.

Go to Start Menu, click Run, type "cmd", and then click OK.

Type the following command at the command prompt:

C:\Inetpub\AdminScripts>cscript.exe adsutil.vbs set /w3svc//SecureBindings "*:443 :< host header>"

For example

C:\Inetpub\AdminScripts>cscript.exe adsutil.vbs set /w3svc/1/SecureBindings "10.0.0.1:443:test1.myserver.com"

Do this for all the three sites

C:\Inetpub\AdminScripts>cscript.exe adsutil.vbs set /w3svc/2/SecureBindings "10.0.0.1:443:test2.myserver.com"

C:\Inetpub\AdminScripts>cscript.exe adsutil.vbs set /w3svc/3/SecureBindings "10.0.0.1:443:test3.myserver.com"

You can also change this by changing the metabase.xml for that particular site.

For Example your site id is 1 then you would see following in the Metabase.xml

AuthFlags="0"

SSLCertHash="ee6c56aaacd9e52137ccd4563131c35bdb020712"

SSLStoreName="MY"

SecureBindings=":443:"

ServerAutoStart="TRUE"

ServerBindings=":80:"

ServerComment="ssltest">

Add the hostname in the SecureBindings explicitly for each site.

AuthFlags="0"

SSLCertHash="ee6c56aaacd9e52137ccd4563131c35bdb020712"

SSLStoreName="MY"

SecureBindings=":443:www.test.com"

ServerAutoStart="TRUE"

ServerBindings=":80:"

ServerComment="ssltest">

IIS7

In IIS7, attaching a wild card certificate is much easier. You can attach the certificate to the website you need to attach to. The moment you select the wildcard certificate the hostname field in the UI will be enabled. You can type the host header in it. You can do the same procedure for multiple sites.

How Wild Card Certificate resolve the Chicken and Egg problem

We have multiple sites on same IP: Port with the same certificate (wildcard certificate) attached to them. When the request reach to HTTP.SYS layer, the Schannel gets the IP: Port information from the request. Since there is only one certificate attached to that IP: Port Schannel use that wildcard certificate and decrypt the request using the private key. After decrypting the request, HTTP.SYS is able to get the host header information. Using the host header, HTTP.SYS can put the request into the proper request queue.

Limitation of Wild Card Certificate.

There are certain limitations of wild card certificate.

1) It can only be applicable to single level of subdomain. For example you got a wild cart certificate for *.mydomain.com then you can bind this certificate to sites such as site1.mydomain.com or site2.mydomain.com. However, you cannot bind the wildcard certificate to Site1.myexample.mydomain.com or Site1.example2.mydomain.com or xyz.abc.mydomain.com etc.

That means the wild cart certificate will work only till first level of subdomain.

2) The wild card certificate will work only if the site has same domain name. That means if you have certificate for *.mydomain.com then you cannot bind this certificate to sites such as www.example.com or www.mydomain2.com etc. Wild card certificate will work only for sites which have same domain name.

3) You can set the wildcard certificate only for one top level domain. For example you can bind a wild card certificate for www.test1.myserver.com or www.test2.myserver.com, but you cannot bind the same certificate for hostheader www.test2.myserver.org or www.test2.myserver.net etc.

SAN Certificate (Subject Alternative Name Certificate)

You can setup the wildcard certificate if the domain name for all the sites are same and first level subdomain changes. What if you want to set up the sites which should work on two different domain names, for example, a site with host header as www.testserver1.com and another site with hostheader as www.testserver2.com. In this case Wildcard certificate won’t help you. To resolve this issue we have SAN Certificate.

A SAN cert allows for multiple domain names to be protected with a single certificate. For example, you could get a certificate for myserver.com, and then add more SAN values to have the same certificate protect myserver.org, myserver.net and even myserver2.com or www.example.com.

You can see the domain names in the Subject Alternative Name option in the Certificate

Setup the SAN certificate in IIS

Let’s say you need following configuration

So let’s say you have the following configuration:

Website                   Host Header Value                  IP Address      Port             SSL Port 
================================================================== 
Test1                         www.test.edu               10.0.1.1              80                  443 
Test2                        www.test.com               10.0.1.1              80                  443

Test3                    www.test.testing.com 10.0.1.1             80                  443

IIS 6

You need to select the SAN certificate for all the three sites which are configured for same IP-Address and port.

Note: The hostheaders which are defined in the Subject Alternative Name, only to those hostheaders you can bind the site. That means if you set the Subject Alternative Name to www.test.edu, www.test.com, www.test.testing.com then you cannot bind this certificate to a site with hostheader say www.example.com.

To know how to bind the certificates please follow the following link

http://blogs.iis.net/robert_mcmurray/archive/2011/02/17/iis-6-setting-up-ssl-part-3-installing-the-certificate.aspx

After you installed the Certificate on all the websites with same IP address and port and you try to browse the sites. You will see that all of the HTTPS responses come from one specific site.

That means if you try to access https:// www.test.edu, https://www.test.com or https://www.test.testing.com you will get the response from one site only.

You won’t get the corresponding pages from different Websites depending upon the site in URL. Why? Because of the chicken and Egg problem remember. When the request comes to HTTP.SYS layer then Schannel will be able to decrypt the request but after decrypting the request it doesn’t know which site it needs to send the request as all the sites listening to same IP-Address and port.

You will also see that only one of the Websites will be running. Other Websites will be in stopped state because we cannot have multiple Websites running with same IP and same SSL port binding. If you try to start the other Websites you may see something like this below:

How to resolve above issue

To resolve this issue we need to add host headers to the sites.

Go to Start Menu, click Run, type "cmd", and then click OK.

Type the following command at the command prompt:

C:\Inetpub\AdminScripts>cscript.exe adsutil.vbs set /w3svc//SecureBindings "*:443 :< host header>"

For example

C:\Inetpub\AdminScripts>cscript.exe adsutil.vbs set /w3svc/1/SecureBindings "10.0.0.1:443:www.test.edu"

Do this for all the three sites

C:\Inetpub\AdminScripts>cscript.exe adsutil.vbs set /w3svc/2/SecureBindings "10.0.0.1:443:www.test.com"

C:\Inetpub\AdminScripts>cscript.exe adsutil.vbs set /w3svc/3/SecureBindings "10.0.0.1:443:www.test.testing.com"

You can also change this by changing the metabase.xml for that particular site

AuthFlags="0"

SSLCertHash="ee6c56aaacd9e52137ccd4563131c35bdb020712"

SSLStoreName="MY"

SecureBindings=":443:"

ServerAutoStart="TRUE"

ServerBindings=":80:"

ServerComment="ssltest">

Add the hostname in the SecureBindings explicitly for each site.

AuthFlags="0"

SSLCertHash="ee6c56aaacd9e52137ccd4563131c35bdb020712"

SSLStoreName="MY"

SecureBindings=":443:www.test.com"

ServerAutoStart="TRUE"

ServerBindings=":80:"

ServerComment="ssltest">

IIS7

You need to select the certificate for all the three sites which are configured for same IP-Address and port.

Note: The hostheaders which are defined in the Subject Alternative Name, only to those hostheaders you can bind the site. That means if you set the Subject Alternative Name to www.test.edu, www.test.com, www.test.testing.com then you cannot bind this certificate to a site with hostheader say www.example.com.

To know how to bind the certificates in IIS7 please follow the following link

http://www.iis.net/learn/manage/configuring-security/how-to-set-up-ssl-on-iis

To configure the SAN certificate you need to run the below command after changing the website name, ip-address and port and the host header value.

Go to Start Menu, click Run, type "cmd", and then click OK.

Go to the location “C:\Windows\System32\inetsrv”

Type the following command at the command prompt:

appcmd set site /site.name:”” /+bindings.[protocol=’https’,bindingInformation=’*:443:‘]

For example

appcmd set site /site.name:"Test1" /+bindings.[protocol=’https’,bindingInformation=’*:443:www.test.edu’]

appcmd set site /site.name:"Test2" /+bindings.[protocol=’https’,bindingInformation=’*:443:www.test.com’]

appcmd set site /site.name:"Test3" /+bindings.[protocol=’https’,bindingInformation=’*:443:www.test.testing.com’]

Alternatively you can go to the applicationhost.config and modify the binding part of the website to add the host header. Do this for all the three sites. For example

How SAN Certificate resolve the Chicken and Egg problem

We have multiple sites on same IP: Port with the same certificate (SAN certificate) attached to them. When the request reach to HTTP.SYS layer, the Schannel gets the IP: Port information from the request. Since there is only one certificate attached to that IP: Port Schannel use that SAN certificate and decrypt the request using the private key. After decrypting the request, HTTP.SYS is able to get the host header information. Using the host header, HTTP.SYS can put the request into the proper request queue.

Limitation of SAN Certificate.

There are certain limitations of SAN certificate.

1) One major limitation of SAN certificate is if you have issued the SAN certificate for say two host-headers www.test1.com and www.test2.edu but you need to setup a site for www.test3.net using the same certificate then you can’t use it. You need to get another SAN certificate from the CA with all the three host-headers. In short, for every addition of a host-header you need to get another SAN certificate.

2) There are certain limitations which are defined by the CA on the number of host-header you can add to the Certificate. That means, after a certain number of host-header you cannot add further host-header into it.

Server Name Indication in IIS8

IIS8 has a new functionality called Server Name Indication (SNI) to overcome this problem. To know more about SNI please follow the following links

http://www.iis.net/learn/get-started/whats-new-in-iis-8/iis-80-server-name-indication-sni-ssl-scalability

http://blogs.msdn.com/b/kaushal/archive/2012/09/04/server-name-indication-sni-in-iis-8-windows-server-2012.aspx