Server 2019上的ASP.NET 4.7-HTTPS提供HTTP 503-服务不可用（在Http上运行）
[英]ASP.NET 4.7 on Server 2019 - HTTPS giving HTTP 503 - Service Unavailable (Works on Http)
问题描述
We're trying to test our web apps on Server 2019 to see how they're going to work. 
我们正在尝试在Server 2019上测试我们的Web应用程序，以查看它们如何运行。 We have our Team City deploy working, and now I'm trying to figure out what's going on with Server 2019. 我们已经部署了Team City部署，现在我想弄清楚Server 2019的情况。
Any page on https:// gives me the error: https：//上的任何页面都会给我错误：
Source: 资源：
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>Service Unavailable</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>
<BODY><h2>Service Unavailable</h2>
<hr><p>HTTP Error 503. The service is unavailable.</p>
</BODY></HTML>
If I go to a page on Http:// it works. 如果我转到Http：//上的页面，则可以使用。
There is nothing else going on with this. 没有其他事情了。
The Application 应用程序
The application is an ASP.NET 4.6 MVC app. 该应用程序是ASP.NET 4.6 MVC应用程序。 It currently works on multiple servers from 2012 to 2016, and windows 10 w/o issues. 从2012年到2016年，它目前可在多台服务器上工作，并且Windows 10没有问题。
Setup: 设定：
- Brand new AWS EC2 (Web App) 全新的AWS EC2（Web应用程序）
- All ASP.NET Services for 4.7 have been installed. 已安装所有4.7的ASP.NET服务。
- SQL Server is installed on this EC2 在此EC2上安装了SQL Server
- List item 项目清单
- IIS is setup with correct app pools (and they're started) 使用正确的应用程序池设置了IIS（并且它们已启动）
- Bindings are correct 绑定是正确的
- I have given NEtwork Services and IIS USER full control over the /website/ folder 我已经授予NEtwork Services和IIS USER对/ website /文件夹的完全控制权
- Binding Information: 绑定信息：
What I've done 我做了什么
- gone through ~30 posts on HTTP 503 w/o any luck. 经历了30条关于HTTP 503的帖子，没有任何运气。
- I added a test.html page to one of the applications. 我在其中一个应用程序中添加了一个test.html页面。 I still get a HTTP 503 with this. 我仍然得到一个HTTP 503。
- verified the root SSL cert is installed correclty 验证是否正确安装了根SSL证书
- installed intermediate ssl certs 已安装中间ssl证书
- Added a new user to the server, gave them "All" permissions and full control over /websites/, set them as the user in the App Pool (restarted app pool) and still a 503. 向服务器添加了一个新用户，授予他们“所有”权限并完全控制/ websites /，将他们设置为应用程序池（重新启动的应用程序池）中的用户，仍然为503。
- Quintuple checked the app pools to make sure they're started. Quintuple检查了应用程序池以确保它们已启动。 They are started. 他们开始了。
- I do not see any errors in the Event Logs or /Server Roles/ Web Server (IIS) logs. 我在事件日志或/ Server Roles / Web服务器（IIS）日志中看不到任何错误。
- Running the command: netsh http show urlacl url= https://+:443/ 运行命令：netsh http show urlacl url = https：// +：443 /
I get both of these at times: 我有时会同时遇到这两种情况：
Reserved URL : https://+:443/
Can't get security descriptor, Error: 87
Reserved URL : https://+:443/
SDDL: O:NS
I'm at a loss as I have no other information as to why 503 is coming back. 我不知所措，因为我没有其他任何关于503为何回来的信息。 It's almost as if IIS isn't running, as it's not even able to server up a test.html page. 几乎好像IIS没有运行，因为它甚至无法为test.html页面提供服务器。 I fully expect this to be something dead simple where I'll face palm for a week or something unique with Server 2019. 我完全希望这会变得非常简单，我将面临一个星期的掌控或Server 2019的独特之处。
1 个解决方案
解决方案1
1 已采纳 2019-09-11 13:41:08
Root cause extracted from comments troubleshooting: 从注释疑难解答中提取的根本原因：
In the event that IIS is serving an application on http but receiving 503 service unavailable for https AND it is confirmed that both http and https protocols are enabled, verify that the SSL port 443 is not reserved by the system. 如果IIS在http上为应用程序提供服务，但收到503服务不适用于https，并且确认已启用http和https协议，请确认系统未保留SSL端口443。
You may do this by running the following from command line: 您可以通过从命令行运行以下命令来执行此操作：
netsh http show urlacl url=https://+:443/
If the output confirms that the URL is reserved then you have two options: 如果输出确认URL已保留，那么您有两个选择：
Delete the reservation by running command
通过运行命令删除预订 netsh http delete urlacl https://+:443/
***If reserved port must remain intact (Run cmd netstat -a -n -o | findstr 443 to find the PID running on the port and use process explorer to identity the process from the PID) then use option 2 ***如果保留的端口必须保持完整（运行cmd netstat -a -n -o | findstr 443以查找端口上运行的PID，并使用进程浏览器从PID识别进程），则使用选项2
- Re-provision your application to run on port 8443 (assuming that is not also shown in the reserved url list. 重新配置您的应用程序以在端口8443上运行（假设保留的URL列表中也未显示该端口）。
***Although you can use any port to run SSL, browsers automatically prefix 443 and 8443 with https. ***尽管您可以使用任何端口运行SSL，但浏览器会自动为443和8443加上https前缀。 Applications using SSL comms on ports other than 443 and 8443 must take special care to redirect users to https as browser will not auto prefix. 在443和8443以外的端口上使用SSL comms的应用程序必须格外小心，以将用户重定向到https，因为浏览器不会自动添加前缀。 Also to note that it is common practice for some access points disable comms not coming over 80 or 443 so environmental factors may play into the usage of switching the port...ie do your due diligence for your users :) 还要注意，某些接入点的惯常做法是禁用不超过80或443的通信，因此环境因素可能会影响切换端口的使用...即，对用户进行尽职调查:)
声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.