Security - One web service for authentication used by many internal websites. Where does the Cert go?

We have an internal web service that handles authentication. Some one noticed it is http.

I have changed it to https.  I believe a certificate needs to be applied but the question is where does it go? On the web service or on the individual web sites that use the service?

I hope it can be placed on the web service because otherwise we will need a basket load of certs.

Any help would be appreciated.

Thanks.

It goes on the web service site.  Your other sites that use the service will need to have their code adjusted to interact with it via SSL.  Depending on your setup, it may be as simple as modifying their web.config file(s).

Thanks Robbe

I think I have this setup correctly but I don't know how to test this to make sure it is using SSL for the web service call.

In IIS 7 from the Actions pane if I click Browse *:80 (http) I get a web page warning me HTTP Error 403.4 - Forbidden, The page you are trying to access is secured with Secure Sockets Layer (SSL).

If I click Browse *:443 (https) I get a web page warning me There is a problem with this website's security certificate. When I click Continue bla bla I get an Error Summary that says HTTP Error 403.14 - Forbidden, The Web server is configured to not list the contents of this directory.

Does that mean SSL worked?

When I add my service reference to my web site if I do not specify https I get and error. Using https allows the reference to complete.

When I use the site the background call to the web service works but HOW CAN I KNOW SSL IS BEING USED?

Did you install the certificate that you purchased from your ISP or other organization?

The cert was already installed at the root level.

On my web service I double-clicked the SSL Settings and chose REQUIRE SSL and REQUIRE 128-BIT SSL. I then chose to IGNORE CLIENT CERTIFICATES.

And, you've set your WCF web site to use that specific cert? 

Is it a wildcard cert? ex. *.nullskull.com

If not, does the domain name for the cert match your exact domain used for the WCF service? 

If you can't browse to https://henrydomaingoeshere.com/someservicepage.svc without the browser through up cert warnings and errors, your client apps won't be able to use your service.

This service is for users to login.

Using Chrome when I go to https://DOMAIN/PathToWebService/webservice.asmx I see a link for the web service. When I click it I see a sample login screen followed by the SOAP 1.1 and SOAP 1.2 stuff along with HTTP GET and HTTP POST stuff.

When I login I then see "This XML file does not appear to have any style information associated with it. The document tree is shown below.

Below that is:
<string xmlns="http:localhost/">Success</string>

What concerns me is in the url bar there is an X on a padlock and the https has a red line crossing it.

DOMAIN is what the cert is assigned to.

UPDATE:

Clicking on the padlock near the url bar pops up a windows that says the site uses a weak security config: SHA-1

Looking at the properties of the cert it does in fact use that.

I think it is working.

128 bit cert is pretty weak these days.  IF you are not getting errors indicating problems with the cert, then you should be set.

Should I un-check 128-bit Cert?

The cert itself is what sets the encryption complexity.  So, to increase yours, you'd have to buy a new cert.  The more complex, the more expensive.  You'd want to talk this over with your system admin and your ISP.