This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(92.8, 7.000000000000001%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EFC%3C/text%3E%3C/svg%3E)
Hello.
I have ARR 3.0 installed and I want to set the SecureConnectionIgnoreFlags to ignore expired certificates for health checking as described in https://learn.microsoft.com/en-us/iis/extensions/configuring-application-request-routing-arr/arr-support-added-for-winhttpoptionsecurityflags
This article indicated that there's a hotfix for ARR 2.5, https://www.microsoft.com/en-us/download/details.aspx?id=35827 and this hotfix won't install on ARR 3.0
I added the registry setting but it doesn't seem to work.
I also found this KB, https://support.microsoft.com/en-us/topic/june-2016-hotfix-for-microsoft-application-request-routing-3-0-8855fd9c-1d0c-7704-f10b-de18e6efa9b1 but the download link is broken.
Can someone confirm if SecureConnectionIgnoreFlags is supported out of the box w/ ARR 3.0?
Thanks a lot.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(150.4, 0%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EXP%3C/text%3E%3C/svg%3E)
Hi @Frank Cheung,
What version of IIS are you currently using? I see that the documents you provided are all applicable to IIS 8/IIS 8.5.
In addition, how did you configure this registry (what value you configured), you can try something like this and check if this work:
reg.exe add "HKLM\SOFTWARE\Microsoft\IIS Extensions\Application Request Routing\Parameters" /v SecureConnectionIgnoreFlags /t REG_DWORD /d 0x00003300
Hi.
The server is running Windows 2022 and IIS 10. ARR version is 3.0.
Here's a screenshot of the registry. I restarted IIS after inserting the registry value
Hi @Frank Cheung,
Does this work for you? If it still doesn't work, could you provide detailed error messages?
No. It doesn't work. I get the 502.3 gateway error.
Once I replace the certificate on the worker / web node with one that is not expired, it started working again.
Hi @Frank Cheung,
Try to modify the value to 0x00003300 and check if this work.
No. It doesn't work. What's really strange is that it worked for like 4 to 5 hours and then i stop seeing traffic coming to one of the web node that has an expired certificate.
IIS manager still shows the node as health but I get 503.4 error
Hi @Frank Cheung,
What's really strange is that it worked for like 4 to 5 hours and then i stop seeing traffic coming to one of the web node that has an expired certificate.
You mean after changing the configuration it worked for a while?
IIS manager still shows the node as health but I get 503.4 error
This error code means: FastCGI queue full. Maybe you can check the relevant log information for more details.