If a Microsoft CA's CertSrv site in IIS only offers Windows Authentication, VCF Operations gets HTTP 401 errors when asking it to sign certificates. Turning on Basic Authentication there fixes that.
Read more: Broadcom TechDocs
In the Ultra Transcenders books
Each book explains Basic Authentication in context, with comparison tables and the common traps.
Terms in this definition
- Microsoft CA
Certificate authority built on Microsoft AD Certificate Services. Once a suitable template exists and IIS has Basic Authentication on for CertSrv, VCF can have it sign and automatically renew certificates for its parts.
- LSDOU
The sequence in which Group Policy is processed: the local policy first, followed by site, domain and organisational unit policies. The nearest, last-processed setting takes effect unless Enforced or Block Inheritance alters that.
- IIS
Internet Information Services, Microsoft's web server, where a Microsoft CA's CertSrv enrolment pages live. VCF cannot get certificates from that CA until Basic Authentication is switched on there.
- Authentication
Checking an identity claim made by a person, device or app, for instance by asking for a password plus an extra factor. Authorisation only happens once this step has succeeded.
- VCF Operations
VCF's console for running the fleet. It covers alerting, monitoring, capacity, reporting, log analysis and licensing alongside fleet management of identity, passwords, certificates and lifecycle.
- HTTP
Hypertext Transfer Protocol, which sends data in clear text; VCF interfaces and APIs instead use HTTPS.
Related terms
- Deployment credentials
Username and password pairs for local Git and FTP/S on App Service. They use basic authentication and are not Entra identities.
- Legacy authentication
Older protocols, such as Exchange ActiveSync and legacy mail apps (the Other clients category), that sign in with basic authentication. MFA isn't possible with them, so Conditional Access policies use the client apps condition to block them.
- Publish profile
Per-app credentials for App Service, usable by GitHub Actions and other deployment tools. Basic authentication has to stay enabled for it to work, which is why OpenID Connect is the better option.
- Secure Webhook
Calls an endpoint secured with Microsoft Entra ID from an Azure Monitor action group; basic authentication can't be used. It supersedes the IT Service Management Connector for BMC Helix and ServiceNow.