0

I'm trying to connect a Windows Vista client to a Lanier LD445c (scanner/copier/printer) using IPP over SSL/TLS in order to provide an encrypted channel for printing. The LD445c that I setup for testing is using a self-signed certificate and I'm using the drivers straight from the manufacturer.

Windows XP clients work fine when I set up the printer using https, but when I attempt with Vista Enterprise client it flat out refuses to map the printer. I've done packet captures that show that the client makes a succesful connection to the printer, but after a brief exchange of packets the client sends a RST.

  • Does Windows Vista support IPP over SSL/TLS?
  • If so, is there a straightforward guide that explains how to get it set up?.
  • If not, what options of encrypting print jobs do I have?
Bob
  • 2,559
  • 3
  • 25
  • 22

1 Answers1

1

Here's a nice blog entry describing the tribulations associated with getting IPP over SSL to work from an MSFT employee: http://blogs.msdn.com/spatdsg/archive/2007/08/08/-Putting-CAPI2-logging-to-good-use.aspx

Basically, XP didn't care about a self-signed cert on IPP resources being accessed with HTTPS, but Vista does. Surprise, surprise.

You have 3 choices:

  • Install the CA certificate used to sign the printer's cert onto your client(s) (can be published via AD - see http://technet.microsoft.com/en-us/library/cc738131(WS.10).aspx).

  • Use your own enterprise CA that your clients already trust to sign the certificate for the printer (if you have one)

  • Get a certificate from a third-party CA that the clients already trust for the printer (which seems like an expensive and bad idea)

That blog post goes thru generating a self-signed cert on a client computer. I don't have any Lanier documentatation, but presumably there's somewhere in the web interface that you could upload a certificate and a private key.

Evan Anderson
  • 141,071
  • 19
  • 191
  • 328
  • So is mine, I've already tried importing the self-signed cert. Going to try a real cert and see what what happens. – Bob Jul 24 '09 at 19:24
  • @Bob: I dropped an edit on here that has a link to a blog entry w/ more details. Have a look. – Evan Anderson Jul 24 '09 at 19:30
  • Your google-fu is strong. So it's hates my self-signed cert because the CN's don't match. good ol' Vista, protecting me from myself. I love that CAPI2 event log as well. – Bob Jul 24 '09 at 19:56
  • Thanks Evan! As always you ability to speedily answer every concievable question is mind boggling :-) – Bob Jul 24 '09 at 19:58
  • My gut was just *screaming* "self-signed cert... Vista HATES self-signed certs" as I read the question. Glad that I was able to home-in on the answer for you. (I'm working on being the Jon Skeet of Server Fault, eh?) – Evan Anderson Jul 24 '09 at 20:18