{"id":11700,"date":"2025-03-31T11:01:47","date_gmt":"2025-03-31T02:01:47","guid":{"rendered":"https:\/\/chat-messenger.com\/?p=11700"},"modified":"2025-04-25T14:39:43","modified_gmt":"2025-04-25T05:39:43","slug":"windowsauthentication-loadbalancer-ssl","status":"publish","type":"post","link":"https:\/\/chat-messenger.com\/vi\/blog\/windowsauthentication-loadbalancer-ssl","title":{"rendered":"C\u00e1ch c\u1ea5u h\u00ecnh X\u00e1c th\u1ef1c Windows t\u00edch h\u1ee3p IIS \u0111\u1ec3 th\u00e0nh c\u00f4ng trong m\u00f4i tr\u01b0\u1eddng c\u00e2n b\u1eb1ng t\u1ea3i + SSL"},"content":{"rendered":"<h2>Gi\u1edbi thi\u1ec7u v\u1ec1 X\u00e1c th\u1ef1c Windows t\u00edch h\u1ee3p<\/h2>\n\n\n\n<p>X\u00e1c th\u1ef1c Windows t\u00edch h\u1ee3p l\u00e0 c\u01a1 ch\u1ebf t\u1ef1 \u0111\u1ed9ng cung c\u1ea5p th\u00f4ng tin x\u00e1c th\u1ef1c ng\u01b0\u1eddi d\u00f9ng cho IIS khi IIS v\u00e0 ng\u01b0\u1eddi d\u00f9ng thu\u1ed9c c\u00f9ng m\u1ed9t mi\u1ec1n Active Directory. Khi b\u1ea1n t\u1ea1o m\u1ed9t trang web b\u1eb1ng ASP.NET C#, b\u1ea1n c\u00f3 th\u1ec3 x\u00e1c \u0111\u1ecbnh xem ng\u01b0\u1eddi d\u00f9ng \u0111\u00e3 \u0111\u01b0\u1ee3c x\u00e1c th\u1ef1c hay ch\u01b0a v\u00e0 thu th\u1eadp th\u00f4ng tin v\u1ec1 nh\u1eefng ng\u01b0\u1eddi d\u00f9ng \u0111\u00e3 \u0111\u01b0\u1ee3c x\u00e1c th\u1ef1c.<\/p>\n\n\n\n<p>\u0110i\u1ec1u n\u00e0y cho ph\u00e9p ng\u01b0\u1eddi d\u00f9ng truy c\u1eadp c\u00e1c \u1ee9ng d\u1ee5ng web \u0111\u01b0\u1ee3c l\u01b0u tr\u1eef (ho\u1eb7c li\u00ean k\u1ebft) b\u1edfi IIS m\u00e0 kh\u00f4ng c\u1ea7n thao t\u00e1c \u0111\u0103ng nh\u1eadp b\u1ed5 sung v\u00e0 cho ph\u00e9p t\u00edch h\u1ee3p SSO v\u1edbi c\u00e1c m\u00e1y ch\u1ee7 \u1ee9ng d\u1ee5ng kh\u00e1c.<\/p>\n\n\n\n<p>Tuy nhi\u00ean, trong m\u00f4i tr\u01b0\u1eddng m\u00e0 m\u00e1y ch\u1ee7 web (IIS) n\u1eb1m d\u01b0\u1edbi b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i v\u00e0 giao ti\u1ebfp \u0111\u01b0\u1ee3c m\u00e3 h\u00f3a b\u1eb1ng SSL\/TLS, x\u00e1c th\u1ef1c Windows n\u00e0y c\u00f3 th\u1ec3 kh\u00f4ng ho\u1ea1t \u0111\u1ed9ng b\u00ecnh th\u01b0\u1eddng.<span class=\"swl-marker mark_orange\">T\u1ea1i sao v\u1eady?<\/span><\/p>\n\n\n\n<div class=\"wp-block-columns\">\n<div class=\"wp-block-column\">\n<p class=\"is-style-icon_pen has-small-font-size\">N\u1ebfu x\u00e1c th\u1ef1c Windows th\u00e0nh c\u00f4ng, b\u1ea1n s\u1ebd c\u00f3 th\u1ec3 truy c\u1eadp trang x\u00e1c th\u1ef1c m\u1ed9t c\u00e1ch li\u1ec1n m\u1ea1ch, nh\u01b0ng n\u1ebfu kh\u00f4ng th\u00e0nh c\u00f4ng, m\u1ed9t n\u00fat quay s\u1ed1 \u0111\u0103ng nh\u1eadp s\u1ebd \u0111\u01b0\u1ee3c hi\u1ec3n th\u1ecb. N\u1ebfu b\u1ea1n kh\u00f4ng x\u00e1c th\u1ef1c \u0111\u00fang, b\u1ea1n s\u1ebd nh\u1eadn \u0111\u01b0\u1ee3c L\u1ed7i HTTP 401.1 \u2013 Kh\u00f4ng \u0111\u01b0\u1ee3c ph\u00e9p.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column\">\n<figure class=\"wp-block-image size-large is-resized\"><img src=\"https:\/\/chat-messenger.com\/wp-content\/uploads\/2025\/01\/image.png\" alt=\"\" width=\"459\" height=\"193\"\/><\/figure>\n<\/div>\n<\/div>\n\n\n\n<p>V\u1ea5n \u0111\u1ec1 l\u00e0 <strong>X\u00e1c th\u1ef1c Windows ho\u1ea1t \u0111\u1ed9ng nh\u01b0 th\u1ebf n\u00e0o<\/strong> V\u00e0 <strong>Ho\u1ea1t \u0111\u1ed9ng c\u00e2n b\u1eb1ng t\u1ea3i<\/strong> n\u1eb1m \u1edf \u0111\u00e2u.<\/p>\n\n\n\n<p>NTLM l\u00e0 ph\u01b0\u01a1ng ph\u00e1p x\u00e1c th\u1ef1c th\u1eed th\u00e1ch\/ph\u1ea3n h\u1ed3i th\u00f4ng qua m\u1ed9t k\u1ebft n\u1ed1i TCP duy nh\u1ea5t gi\u1eefa m\u1ed7i m\u00e1y kh\u00e1ch v\u00e0 m\u00e1y ch\u1ee7. V\u1edbi Kerberos, m\u00e1y kh\u00e1ch c\u0169ng s\u1ebd nh\u1eadn \u0111\u01b0\u1ee3c v\u00e9 d\u1ef1a tr\u00ean m\u00e3 \u0111\u1ecbnh danh d\u1ecbch v\u1ee5 (SPN) v\u00e0 g\u1eedi \u0111\u1ebfn IIS. Nh\u1eefng th\u00f4ng tin x\u00e1c th\u1ef1c n\u00e0y \u0111\u01b0\u1ee3c g\u1eedi qua ti\u00eau \u0111\u1ec1 HTTP (<code>Quy\u1ec1n h\u1ea1n: \u0110\u00e0m ph\u00e1n ...<\/code> C\u00e1c giao d\u1ecbch \u0111\u01b0\u1ee3c th\u1ef1c hi\u1ec7n b\u1eb1ng nh\u1eefng ph\u01b0\u01a1ng ph\u00e1p nh\u01b0 v\u1eady. Tuy nhi\u00ean, b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i L\u1edbp 7 s\u1ebd ch\u1ea5m d\u1ee9t k\u1ebft n\u1ed1i HTTPS t\u1eeb m\u00e1y kh\u00e1ch tr\u00ean thi\u1ebft b\u1ecb c\u1ee7a ri\u00eang n\u00f3, ph\u00e2n t\u00edch n\u1ed9i dung v\u00e0 chuy\u1ec3n ti\u1ebfp n\u1ed9i dung \u0111\u00f3 \u0111\u1ebfn IIS \u1edf ph\u00eda sau d\u01b0\u1edbi d\u1ea1ng m\u1ed9t y\u00eau c\u1ea7u m\u1edbi. Trong qu\u00e1 tr\u00ecnh n\u00e0y<span class=\"swl-marker mark_blue\">Phi\u00ean TLS \u0111\u1ea7u cu\u1ed1i gi\u1eefa m\u00e1y kh\u00e1ch v\u00e0 IIS s\u1ebd k\u1ebft th\u00fac.<\/span>H\u01a1n n\u1eefa, th\u00f4ng tin x\u00e1c th\u1ef1c li\u00ean t\u1ee5c nh\u01b0 NTLM kh\u00f4ng \u0111\u01b0\u1ee3c l\u01b0u gi\u1eef, khi\u1ebfn qu\u00e1 tr\u00ecnh x\u00e1c th\u1ef1c kh\u00f4ng th\u00e0nh c\u00f4ng.<\/p>\n\n\n\n<p>D\u1ef1a tr\u00ean b\u1ed1i c\u1ea3nh tr\u00ean, b\u00e0i vi\u1ebft n\u00e0y <strong>&quot;<strong>B\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i<\/strong><\/strong> <strong>+ C\u1ea5u h\u00ecnh X\u00e1c th\u1ef1c Windows t\u00edch h\u1ee3p IIS \u0111\u1ec3 th\u00e0nh c\u00f4ng trong m\u00f4i tr\u01b0\u1eddng SSL<\/strong> Ch\u00fang ta s\u1ebd xem x\u00e9t nh\u1eefng \u0111i\u1ec1u sau. Ch\u00fang t\u00f4i s\u1ebd li\u1ec7t k\u00ea ba m\u1eabu c\u1ea5u h\u00ecnh \u0111i\u1ec3n h\u00ecnh v\u00e0 gi\u1ea3i th\u00edch t\u1eebng m\u1eabu xem x\u00e1c th\u1ef1c Windows c\u00f3 \u0111\u01b0\u1ee3c h\u1ed7 tr\u1ee3 hay kh\u00f4ng, l\u00fd do k\u1ef9 thu\u1eadt cho vi\u1ec7c n\u00e0y c\u0169ng nh\u01b0 \u01b0u \u0111i\u1ec3m v\u00e0 nh\u01b0\u1ee3c \u0111i\u1ec3m c\u1ee7a t\u1eebng c\u1ea5u h\u00ecnh.<\/p>\n\n\n\n<h2>Ki\u1ec3m tra k\u1ef9 thu\u1eadt c\u1ee7a t\u1eebng k\u1ebf ho\u1ea1ch c\u1ea5u h\u00ecnh<\/h2>\n\n\n\n<h3>\u2460: B\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i L7 ch\u1ea5m d\u1ee9t SSL + chuy\u1ec3n ti\u1ebfp \u0111\u1ebfn IIS (80 ho\u1eb7c 443)<\/h3>\n\n\n\n<p class=\"is-style-bg_stripe\">M\u00e1y kh\u00e1ch \u2500\u2500HTTPS\u2500\u2500\u25b6 B\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i L7 (ch\u1ea5m d\u1ee9t SSL) \u2500\u2500HTTP(S)\u2500\u2500\u25b6 IIS (80 ho\u1eb7c 443)<\/p>\n\n\n\n<h4><strong>Kh\u1ea3 d\u1ee5ng<\/strong><\/h4>\n\n\n\n<p>C\u1ea5u h\u00ecnh n\u00e0y kh\u00f4ng h\u1ed7 tr\u1ee3 x\u00e1c th\u1ef1c Windows.<span class=\"swl-marker mark_orange\">Kh\u00f4ng c\u00f3 s\u1eb5n<\/span>l\u00e0.<\/p>\n\n\n\n<h4><strong>l\u00fd do<\/strong><\/h4>\n\n\n\n<p>B\u1edfi v\u00ec phi\u00ean TLS gi\u1eefa m\u00e1y kh\u00e1ch v\u00e0 IIS b\u1ecb ch\u1ea5m d\u1ee9t m\u1ed9t l\u1ea7n tr\u00ean b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i,<span class=\"swl-marker mark_blue\">Kh\u00f4ng th\u1ec3 chuy\u1ec3n giao th\u00f4ng tin x\u00e1c th\u1ef1c t\u1eeb \u0111\u1ea7u \u0111\u1ebfn cu\u1ed1i<\/span>\u0110\u00f3 l\u00e0 l\u00fd do t\u1ea1i sao. B\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i L7 gi\u1ea3i m\u00e3 l\u01b0u l\u01b0\u1ee3ng HTTPS \u0111\u00e3 nh\u1eadn v\u00e0 truy c\u1eadp IIS thay m\u1eb7t cho m\u00e1y kh\u00e1ch. V\u00e0o th\u1eddi \u0111i\u1ec3m n\u00e0y, kh\u00e1ch h\u00e0ng n\u00ean g\u1eedi <code>Quy\u1ec1n h\u1ea1n: \u0110\u00e0m ph\u00e1n<\/code> Ti\u00eau \u0111\u1ec1 (ti\u00eau \u0111\u1ec1 x\u00e1c th\u1ef1c bao g\u1ed3m phi\u1ebfu Kerberos v\u00e0 m\u00e3 th\u00f4ng b\u00e1o NTLM) s\u1ebd kh\u00f4ng \u0111\u1ebfn \u0111\u01b0\u1ee3c IIS m\u1ed9t c\u00e1ch ch\u00ednh x\u00e1c. C\u1ee5 th\u1ec3, v\u1edbi NTLM, ph\u1ea3n h\u1ed3i th\u1eed th\u00e1ch x\u00e1c th\u1ef1c m\u00e0 IIS g\u1eedi \u0111\u1ebfn y\u00eau c\u1ea7u ban \u0111\u1ea7u (<code>WWW-X\u00e1c th\u1ef1c<\/code>) kh\u00e1ch h\u00e0ng g\u1eedi l\u1ea1i y\u00eau c\u1ea7u, nh\u01b0ng th\u00f4ng qua LB<span class=\"swl-marker mark_blue\">Phi\u00ean TCP gi\u1ed1ng nhau kh\u00f4ng \u0111\u01b0\u1ee3c duy tr\u00ec<\/span>Do \u0111\u00f3, b\u1eaft tay NTLM kh\u00f4ng th\u00e0nh c\u00f4ng.<\/p>\n\n\n\n<p>Tr\u00ean th\u1ef1c t\u1ebf, ngay c\u1ea3 trong m\u00f4i tr\u01b0\u1eddng AWS, x\u00e1c th\u1ef1c Windows c\u0169ng kh\u00f4ng ho\u1ea1t \u0111\u1ed9ng v\u1edbi Application Load Balancer (ALB) ho\u1eb7c tr\u00ecnh l\u1eafng nghe HTTP v\u00e0 c\u1ea7n c\u00f3 LB c\u1ea5p TCP nh\u01b0 Network Load Balancer (NLB).<a rel=\"noreferrer noopener\" href=\"https:\/\/docs.aws.amazon.com\/ja_jp\/whitepapers\/latest\/replatform-dotnet-apps-with-windows-containers\/using-a-load-balancer-with-windows-authentication.html\" target=\"_blank\">th\u1ea9m quy\u1ec1n gi\u1ea3i quy\u1ebft<\/a>]. Ngo\u00e0i ra, Azure Application Gateway v2 kh\u00f4ng h\u1ed7 tr\u1ee3 vi\u1ec7c truy\u1ec1n ti\u00eau \u0111\u1ec1 HTTP bao g\u1ed3m x\u00e1c th\u1ef1c t\u00edch h\u1ee3p \u0111\u1ebfn ph\u1ea7n ph\u1ee5 tr\u1ee3.<a rel=\"noreferrer noopener\" href=\"https:\/\/learn.microsoft.com\/ja-jp\/azure\/application-gateway\/application-gateway-faq#application-gateway-v1-sku-------------\" target=\"_blank\">th\u1ea9m quy\u1ec1n gi\u1ea3i quy\u1ebft<\/a>].<\/p>\n\n\n\n<p>Th\u1ef1c t\u1ebf l\u00e0 n\u00f3 kh\u00f4ng \u0111\u01b0\u1ee3c h\u1ed7 tr\u1ee3 ch\u00ednh th\u1ee9c b\u1edfi c\u00e1c LB \u0111\u01b0\u1ee3c qu\u1ea3n l\u00fd c\u1ee7a t\u1eebng nh\u00e0 cung c\u1ea5p d\u1ecbch v\u1ee5 \u0111\u00e1m m\u00e2y cho th\u1ea5y kh\u00f3 kh\u0103n trong vi\u1ec7c duy tr\u00ec x\u00e1c th\u1ef1c Windows \u1edf c\u1ea5p L7.<\/p>\n\n\n\n<h3>\u2461: B\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i L4 (chuy\u1ec3n ti\u1ebfp TLS) + chuy\u1ec3n ti\u1ebfp IIS<\/h3>\n\n\n\n<p class=\"is-style-bg_stripe\">M\u00e1y kh\u00e1ch \u2500\u2500HTTPS\u2500\u2500\u25b6 B\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i L4 (chuy\u1ec3n ti\u1ebfp TLS) \u2500\u2500HTTPS\u2500\u2500\u25b6 IIS (443)<\/p>\n\n\n\n<h4><strong>Kh\u1ea3 d\u1ee5ng<\/strong><\/h4>\n\n\n\n<p>C\u1ea5u h\u00ecnh n\u00e0y s\u1eed d\u1ee5ng x\u00e1c th\u1ef1c Windows.<span class=\"swl-marker mark_orange\">T\u01b0\u01a1ng th\u00edch<\/span>l\u00e0.<\/p>\n\n\n\n<h4><strong>l\u00fd do<\/strong><\/h4>\n\n\n\n<p>V\u00ec b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i L4 (LB ho\u1ea1t \u0111\u1ed9ng \u1edf L\u1edbp 4 c\u1ee7a OSI) chuy\u1ec3n ti\u1ebfp c\u00e1c g\u00f3i tin \u1edf c\u1ea5p TCP,<span class=\"swl-marker mark_blue\">Phi\u00ean TLS gi\u1eefa m\u00e1y kh\u00e1ch v\u00e0 IIS \u0111\u01b0\u1ee3c duy tr\u00ec t\u1eeb \u0111\u1ea7u \u0111\u1ebfn cu\u1ed1i<\/span>s\u1ebd \u0111\u01b0\u1ee3c th\u1ef1c hi\u1ec7n. B\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i kh\u00f4ng ch\u1ea5m d\u1ee9t m\u00e3 h\u00f3a m\u00e0 ch\u1ec9 ph\u00e2n ph\u1ed1i k\u1ebft n\u1ed1i TCP t\u1edbi t\u1eebng m\u00e1y ch\u1ee7, do \u0111\u00f3 &quot;giao ti\u1ebfp tr\u00ean c\u00f9ng m\u1ed9t k\u1ebft n\u1ed1i TCP&quot; theo y\u00eau c\u1ea7u x\u00e1c th\u1ef1c NTLM \u0111\u01b0\u1ee3c duy tr\u00ec. \u0110\u1ed1i v\u1edbi Kerberos, theo quan \u0111i\u1ec3m c\u1ee7a kh\u00e1ch h\u00e0ng, n\u00f3 c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c t\u00e1i t\u1ea1o nh\u01b0 th\u1ec3 kh\u00e1ch h\u00e0ng \u0111ang k\u1ebft n\u1ed1i tr\u1ef1c ti\u1ebfp \u0111\u1ebfn FQDN c\u1ee7a IIS (d\u1ecbch v\u1ee5), do \u0111\u00f3, mi\u1ec5n l\u00e0 SPN \u0111\u01b0\u1ee3c thi\u1ebft l\u1eadp ph\u00f9 h\u1ee3p, x\u00e1c th\u1ef1c d\u1ef1a tr\u00ean phi\u1ebfu s\u1ebd ti\u1ebfp t\u1ee5c di\u1ec5n ra nh\u01b0 b\u00ecnh th\u01b0\u1eddng. Ch\u1ebf \u0111\u1ed9 tr\u00ecnh l\u1eafng nghe LB TCP c\u1ed5 \u0111i\u1ec3n v\u00e0 AWS NLB, b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i n\u1ed9i b\u1ed9 Azure, ch\u1ebf \u0111\u1ed9 F5 L4, v.v. thu\u1ed9c v\u1ec1 danh m\u1ee5c n\u00e0y (nh\u1eefng danh m\u1ee5c kh\u00e1c bao g\u1ed3m ch\u1ebf \u0111\u1ed9 HAProxy TCP v\u00e0 lu\u1ed3ng nginx) v\u00e0 c\u00f3 th\u1ec3 v\u01b0\u1ee3t qua x\u00e1c th\u1ef1c t\u00edch h\u1ee3p c\u1ee7a Windows.<\/p>\n\n\n\n<h4><strong>c\u00f4ng lao<\/strong><\/h4>\n\n\n\n<p>Phi\u00ean TLS kh\u00f4ng b\u1ecb gi\u00e1n \u0111o\u1ea1n t\u1eeb m\u00e1y kh\u00e1ch \u0111\u1ebfn m\u00e1y ch\u1ee7.<span class=\"swl-marker mark_blue\">C\u00e1c giao th\u1ee9c x\u00e1c th\u1ef1c c\u1ee7a Windows v\u1eabn ti\u1ebfp t\u1ee5c ho\u1ea1t \u0111\u1ed9ng nh\u01b0 b\u00ecnh th\u01b0\u1eddng<\/span>C\u00f3 th\u1ec3. Qu\u00e1 tr\u00ecnh b\u1eaft tay ba chi\u1ec1u NTLM c\u0169ng \u0111\u01b0\u1ee3c ho\u00e0n t\u1ea5t trong m\u1ed9t k\u1ebft n\u1ed1i duy nh\u1ea5t v\u00e0 phi\u1ebfu Kerberos \u0111\u01b0\u1ee3c m\u00e1y ch\u1ee7 ph\u1ee5 tr\u1ee3 nh\u1eadn ch\u00ednh x\u00e1c. Ngo\u00e0i ra, v\u00ec LB l\u00e0 ho\u1ea1t \u0111\u1ed9ng L4 n\u00ean c\u00f3 chi ph\u00ed th\u1ea5p v\u00e0 c\u00f3 th\u1ec3 \u0111\u1ea1t \u0111\u01b0\u1ee3c th\u00f4ng l\u01b0\u1ee3ng cao.<\/p>\n\n\n\n<h4><strong>\u0110i\u1ec3m tr\u1eeb<\/strong><\/h4>\n\n\n\n<p>Th\u00e1ch th\u1ee9c l\u1edbn nh\u1ea5t khi c\u1ea5u h\u00ecnh b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i L4 l\u00e0 kh\u00f4ng th\u1ec3 th\u1ef1c hi\u1ec7n \u0111\u1ecbnh tuy\u1ebfn chi ti\u1ebft d\u1ef1a tr\u00ean \u0111\u01b0\u1eddng d\u1eabn ho\u1eb7c t\u00ean m\u00e1y ch\u1ee7. V\u00ed d\u1ee5, trong \u0111\u01b0\u1eddng d\u1eabn URL (v\u00ed d\u1ee5:<code>\/api<\/code>,<code>\/tr\u00f2 chuy\u1ec7n<\/code>Ph\u00e2n ph\u1ed1i t\u1eebng y\u00eau c\u1ea7u (ho\u1eb7c nhi\u1ec1u y\u00eau c\u1ea7u) \u0111\u1ebfn m\u1ed9t m\u00e1y ch\u1ee7 ph\u1ee5 tr\u1ee3 kh\u00e1c nhau l\u00e0 t\u00ednh n\u0103ng ch\u1ec9 c\u00f3 th\u1ec3 th\u1ef1c hi\u1ec7n \u0111\u01b0\u1ee3c v\u1edbi L7 (HTTP) v\u00e0 kh\u00f4ng th\u1ec3 th\u1ef1c hi\u1ec7n \u0111\u01b0\u1ee3c v\u1edbi L4 (TCP).<\/p>\n\n\n\n<p>Do \u0111\u00f3, t\u00f9y thu\u1ed9c v\u00e0o y\u00eau c\u1ea7u c\u1ee7a h\u1ec7 th\u1ed1ng, c\u00f3 th\u1ec3 c\u1ea7n ph\u1ea3i chu\u1ea9n b\u1ecb nhi\u1ec1u FQDN v\u00e0 ch\u1ec9 \u0111\u1ecbnh c\u00e1c m\u00e1y ch\u1ee7 \u1ea3o kh\u00e1c nhau cho c\u00e1c m\u1ee5c \u0111\u00edch kh\u00e1c nhau (m\u00e1y ch\u1ee7 web, m\u00e1y ch\u1ee7 x\u00e1c th\u1ef1c Windows, v.v.) trong b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i, \u0111i\u1ec1u n\u00e0y c\u00f3 nh\u01b0\u1ee3c \u0111i\u1ec3m l\u00e0 l\u00e0m cho vi\u1ec7c c\u1ea5u h\u00ecnh tr\u1edf n\u00ean kh\u00f3 kh\u0103n h\u01a1n.<\/p>\n\n\n\n<p>\u0110\u1eb7c bi\u1ec7t, khi truy c\u1eadp trang x\u00e1c th\u1ef1c Windows b\u1eb1ng FQDN (t\u00ean mi\u1ec1n \u0111\u1ee7 \u0111i\u1ec1u ki\u1ec7n), <a href=\"https:\/\/chat-messenger.com\/vi\/blog\/windowsauthentication-setspn\/\">\u0110\u0103ng k\u00fd SPN<\/a> kh\u00e1 ph\u1ee9c t\u1ea1p, v\u00ec v\u1eady h\u00e3y xem b\u00ean d\u01b0\u1edbi.<\/p>\n\n\n<div class=\"swell-block-postLink\">\t\t\t<div class=\"p-blogCard -external\" data-type=\"type3\" data-onclick=\"clickLink\">\n\t\t\t\t<div class=\"p-blogCard__inner\">\n\t\t\t\t\t<span class=\"p-blogCard__caption\">H\u1ed9i th\u1ea3o tr\u00ean web Tr\u00f2 chuy\u1ec7n &amp; Messenger<\/span>\n\t\t\t\t\t<div class=\"p-blogCard__thumb c-postThumb\"><figure class=\"c-postThumb__figure\"><img src=\"https:\/\/chat-messenger.com\/wp-content\/uploads\/2025\/03\/iStock-1313570693-2.jpg\" alt=\"\" class=\"c-postThumb__img u-obf-cover\" width=\"320\" height=\"180\"><\/figure><\/div>\t\t\t\t\t<div class=\"p-blogCard__body\">\n\t\t\t\t\t\t<a class=\"p-blogCard__title\" href=\"https:\/\/chat-messenger.com\/vi\/blog\/windowsauthentication-setspn\/\" target=\"_blank\" rel=\"noopener noreferrer\">Thi\u1ebft l\u1eadp IIS \u0111\u1ec3 x\u00e1c th\u1ef1c Windows t\u00edch h\u1ee3p IIS th\u00e0nh c\u00f4ng trong m\u00f4i tr\u01b0\u1eddng c\u00e2n b\u1eb1ng t\u1ea3i L4 | H\u1ed9i ngh\u1ecb truy\u1ec1n h\u00ecnh Chat&amp;Messenger<\/a>\n\t\t\t\t\t\t<span class=\"p-blogCard__excerpt\">T\u1ed5ng quan B\u00e0i vi\u1ebft sau \u0111\u00e2y gi\u1ea3i th\u00edch c\u00e1ch c\u1ea5u h\u00ecnh X\u00e1c th\u1ef1c Windows t\u00edch h\u1ee3p (IWA) trong IIS trong m\u00f4i tr\u01b0\u1eddng c\u00e2n b\u1eb1ng t\u1ea3i L4 + ch\u1ea5m d\u1ee9t SSL. Ph\u01b0\u01a1ng ph\u00e1p n\u00e0y\u2026<\/span>\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/div>\n\n\n<p>Ngo\u00e0i ra, xin l\u01b0u \u00fd r\u1eb1ng c\u00e1c thi\u1ebft l\u1eadp sau \u0111\u00e2y l\u00e0 b\u1eaft bu\u1ed9c \u0111\u1ec3 x\u00e1c th\u1ef1c Windows \u0111\u1ec1u thi\u1ebft l\u1eadp FQDN c\u1ee7a b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i.<\/p>\n\n\n\n<ul><li>X\u00e1c th\u1ef1c Windows l\u00e0 b\u1eaft bu\u1ed9c trong tab &quot;B\u1ea3o m\u1eadt&quot; c\u1ee7a T\u00f9y ch\u1ecdn Internet.<a href=\"https:\/\/chat-messenger.com\/vi\/thu-cong\/camserver\/toi-dang-o-day\/#internet-options-settings\" data-type=\"URL\" data-id=\"https:\/\/chat-messenger.com\/manual\/camserver\/iis-sso#internet-options-settings\">&quot;M\u1ea1ng n\u1ed9i b\u1ed9&quot; &quot;C\u00e1c trang web&quot;<\/a> c\u00e0i \u0111\u1eb7t<\/li><li>Thi\u1ebft l\u1eadp li\u00ean k\u1ebft trang web IIS v\u00e0 ch\u1ee9ng ch\u1ec9 SSL (Kh\u00f4ng c\u1ea7n c\u00e0i \u0111\u1eb7t ch\u1ee9ng ch\u1ec9 tr\u00ean ch\u00ednh b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i)<\/li><\/ul>\n\n\n\n<h4>Lu\u1ed3ng th\u00e0nh c\u00f4ng Kerberos<\/h4>\n\n\n\n<p>N\u1ebfu FQDN c\u1ee7a b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i l\u00e0 lb.example.com, lu\u1ed3ng \u0111\u1ec3 Kerberos th\u00e0nh c\u00f4ng s\u1ebd nh\u01b0 sau:<\/p>\n\n\n\n<div class=\"hcb_wrap\" data-no-translation=\"\"><pre class=\"prism line-numbers lang-bash\" data-lang=\"Bash\"><code>[Client]\n  | 1. DNS\u89e3\u6c7a: lb.example.com \u2192 LB\n  |\n  | 2. Kerberos: SPN = HTTP\/lb.example.com\n  |             \u2192 \u30c9\u30e1\u30a4\u30f3\u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u30fc\u306bTGS\u3092\u8981\u6c42\n  |\n  | 3. TLS\u30cf\u30f3\u30c9\u30b7\u30a7\u30a4\u30af: SNI = lb.example.com\n  |             \u2192 IIS\u3067\u4e00\u81f4\u3059\u308b\u8a3c\u660e\u66f8\u5fc5\u8981\n  |\n  | 4. \u30ea\u30af\u30a8\u30b9\u30c8\u9001\u4fe1: Host\u30d8\u30c3\u30c0 = lb.example.com\n[IIS]\n  \u2192 SPN\u53d7\u3051\u5165\u308cOK\u3001\u8a3c\u660e\u66f8OK\u3001\u8a8d\u8a3c\u6210\u529f<\/code><\/pre><\/div>\n\n\n\n<h3>\u2462: K\u1ebft th\u00fac SSL c\u1ee7a b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i L7 + chuy\u1ec3n h\u01b0\u1edbng \u0111\u1ebfn c\u1ea5u h\u00ecnh IIS<\/h3>\n\n\n\n<p class=\"is-style-bg_stripe\">M\u00e1y kh\u00e1ch \u2500\u2500HTTPS\u2500\u2500\u25b6 B\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i L7 (ch\u1ea5m d\u1ee9t SSL)<br>LB \u2500\u2500HTTP 302 (Ph\u1ea3n h\u1ed3i chuy\u1ec3n h\u01b0\u1edbng) \u2192 M\u00e1y kh\u00e1ch<br>M\u00e1y kh\u00e1ch \u2500\u2500HTTPS\u2500\u2500\u25b6 IIS (truy c\u1eadp tr\u1ef1c ti\u1ebfp v\u00e0o 443)<\/p>\n\n\n\n<h4><strong>Kh\u1ea3 d\u1ee5ng<\/strong><\/h4>\n\n\n\n<p>C\u1ea5u h\u00ecnh n\u00e0y s\u1eed d\u1ee5ng x\u00e1c th\u1ef1c Windows.<span class=\"swl-marker mark_orange\">T\u01b0\u01a1ng th\u00edch<\/span>l\u00e0.<\/p>\n\n\n\n<h4><strong>l\u00fd do<\/strong><\/h4>\n\n\n\n<p>\u00dd t\u01b0\u1edfng l\u00e0 b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i kh\u00f4ng chuy\u1ec3n ti\u1ebfp th\u00f4ng tin li\u00ean l\u1ea1c th\u1ef1c t\u1ebf m\u00e0 chuy\u1ec3n h\u01b0\u1edbng m\u00e1y kh\u00e1ch tr\u1ef1c ti\u1ebfp \u0111\u1ebfn IIS ph\u1ee5 tr\u1ee3 (ph\u1ea3n h\u1ed3i HTTP 302). L\u1ea7n \u0111\u1ea7u ti\u00ean ng\u01b0\u1eddi d\u00f9ng truy c\u1eadp URL LB, b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i L7 s\u1ebd ch\u1ea5m d\u1ee9t SSL t\u1ea1i \u0111\u00f3, ph\u00e2n t\u00edch n\u1ed9i dung v\u00e0 tr\u1ea3 v\u1ec1 ph\u1ea3n h\u1ed3i 302 v\u1edbi ti\u00eau \u0111\u1ec1 V\u1ecb tr\u00ed \u0111\u1ec3 k\u1ebft n\u1ed1i v\u1edbi \u0111\u1ecba ch\u1ec9 IIS th\u00edch h\u1ee3p (v\u00ed d\u1ee5: t\u00ean m\u00e1y ch\u1ee7 ri\u00eang l\u1ebb ho\u1eb7c \u0111\u1ecba ch\u1ec9 IP cho m\u1ed7i IIS) qua HTTPS. Tr\u00ecnh duy\u1ec7t c\u1ee7a kh\u00e1ch h\u00e0ng nh\u1eadn \u0111\u01b0\u1ee3c l\u1ec7nh chuy\u1ec3n h\u01b0\u1edbng n\u00e0y v\u00e0 t\u1ef1 \u0111\u1ed9ng g\u1eedi l\u1ea1i y\u00eau c\u1ea7u qua HTTPS tr\u1ef1c ti\u1ebfp \u0111\u1ebfn IIS \u0111\u00e3 ch\u1ec9 \u0111\u1ecbnh.<\/p>\n\n\n\n<p>k\u1ebft qu\u1ea3,<span class=\"swl-marker mark_blue\">\u0110\u1ed1i v\u1edbi y\u00eau c\u1ea7u th\u1ee9 hai, m\u00e1y kh\u00e1ch v\u00e0 IIS k\u1ebft n\u1ed1i tr\u1ef1c ti\u1ebfp qua TLS<\/span>Do \u0111\u00f3, th\u00f4ng tin x\u00e1c th\u1ef1c Kerberos\/NTLM \u0111\u01b0\u1ee3c truy\u1ec1n t\u1eeb \u0111\u1ea7u \u0111\u1ebfn cu\u1ed1i theo nguy\u00ean tr\u1ea1ng. V\u00ec b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i kh\u00f4ng can thi\u1ec7p trong qu\u00e1 tr\u00ecnh x\u00e1c th\u1ef1c n\u00ean c\u00f3 th\u1ec3 tr\u00e1nh \u0111\u01b0\u1ee3c v\u1ea5n \u0111\u1ec1 m\u1ea5t ti\u00eau \u0111\u1ec1 x\u00e1c th\u1ef1c nh\u01b0 \u0111\u00e3 th\u1ea5y trong c\u1ea5u h\u00ecnh 1.<\/p>\n\n\n\n<h4><strong>c\u00f4ng lao<\/strong><\/h4>\n\n\n\n<p><span class=\"swl-marker mark_blue\">M\u1ed9t l\u1ee3i th\u1ebf l\u1edbn l\u00e0 TLS \u0111\u01b0\u1ee3c k\u1ebft n\u1ed1i tr\u1ef1c ti\u1ebfp t\u1eeb m\u00e1y kh\u00e1ch t\u1edbi IIS, gi\u00fap x\u00e1c th\u1ef1c Windows d\u1ec5 d\u00e0ng th\u00e0nh c\u00f4ng.<\/span>l\u00e0.<br>N\u1ebfu x\u00e1c th\u1ef1c th\u00e0nh c\u00f4ng ch\u1ec9 b\u1eb1ng IIS, c\u1ea5u h\u00ecnh c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng nh\u01b0 hi\u1ec7n t\u1ea1i, do \u0111\u00f3 kh\u00f4ng c\u00f3 s\u1ef1 gia t\u0103ng \u0111\u1ed9 kh\u00f3 ngay c\u1ea3 khi s\u1eed d\u1ee5ng b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i l\u00e0m trung gian.<\/p>\n\n\n\n<p>Ngo\u00e0i ra, b\u1eb1ng c\u00e1ch s\u1eed d\u1ee5ng chuy\u1ec3n h\u01b0\u1edbng, c\u00f3 th\u1ec3 ki\u1ec3m so\u00e1t \u0111\u1ecbnh tuy\u1ebfn \u1edf m\u1ed9t m\u1ee9c \u0111\u1ed9 linh ho\u1ea1t nh\u1ea5t \u0111\u1ecbnh tr\u00ean ph\u00eda b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i. V\u00ed d\u1ee5, b\u1ea1n c\u00f3 th\u1ec3 \u0111\u1ea1t \u0111\u01b0\u1ee3c \u0111i\u1ec1u g\u00ec \u0111\u00f3 g\u1ea7n gi\u1ed1ng v\u1edbi ph\u00e2n ph\u1ed1i theo \u0111\u01b0\u1eddng d\u1eabn b\u1eb1ng c\u00e1ch chuy\u1ec3n h\u01b0\u1edbng \u0111\u1ebfn c\u00e1c URL IIS ph\u1ee5 tr\u1ee3 kh\u00e1c nhau t\u00f9y thu\u1ed9c v\u00e0o \u0111\u01b0\u1eddng d\u1eabn URL truy c\u1eadp ban \u0111\u1ea7u ho\u1eb7c t\u00ean m\u00e1y ch\u1ee7. N\u1ebfu c\u00f3 nhi\u1ec1u d\u1ecbch v\u1ee5 trong LB, tr\u01b0\u1edbc ti\u00ean c\u00f3 th\u1ec3 t\u1ed5ng h\u1ee3p ch\u00fang v\u00e0o LB nh\u01b0 m\u1ed9t \u0111i\u1ec3m v\u00e0o chung, sau \u0111\u00f3 h\u01b0\u1edbng ng\u01b0\u1eddi d\u00f9ng \u0111\u1ebfn c\u00e1c URL th\u1ef1c t\u1ebf c\u1ee7a t\u1eebng d\u1ecbch v\u1ee5 t\u1eeb \u0111\u00f3, l\u00e0m cho ch\u00fang xu\u1ea5t hi\u1ec7n nh\u01b0 m\u1ed9t tr\u00ean b\u1ec1 m\u1eb7t.<\/p>\n\n\n\n<h4><strong>\u0110i\u1ec3m tr\u1eeb<\/strong><\/h4>\n\n\n\n<p>Nh\u01b0\u1ee3c \u0111i\u1ec3m l\u00e0 IIS kh\u00f4ng th\u1ec3 tri\u1ec3n khai sau LB v\u00e0 ph\u1ea3i thi\u1ebft k\u1ebf m\u1ed9t \u0111i\u1ec3m cu\u1ed1i ri\u00eang cho IIS nh\u01b0 m\u1ed9t m\u00e1y ch\u1ee7 c\u00f4ng c\u1ed9ng v\u00e0 ph\u1ea3i \u0111\u1eb7t m\u1ed9t ch\u1ee9ng ch\u1ec9 kh\u00e1c cho LB.<\/p>\n\n\n\n<p>M\u1ed9t nh\u01b0\u1ee3c \u0111i\u1ec3m kh\u00e1c l\u00e0 vi\u1ec7c chuy\u1ec3n h\u01b0\u1edbng s\u1ebd x\u1ea3y ra khi truy c\u1eadp l\u1ea7n \u0111\u1ea7u, nh\u01b0ng tr\u00ean th\u1ef1c t\u1ebf, vi\u1ec7c k\u1ebft n\u1ed1i l\u1ea1i ngay l\u1eadp t\u1ee9c \u0111\u01b0\u1ee3c th\u1ef1c hi\u1ec7n th\u00f4ng qua ph\u1ea3n h\u1ed3i HTTP 302, do \u0111\u00f3 t\u00e1c \u0111\u1ed9ng \u0111\u1ebfn tr\u1ea3i nghi\u1ec7m c\u1ee7a ng\u01b0\u1eddi d\u00f9ng h\u1ea7u nh\u01b0 kh\u00f4ng \u0111\u00e1ng k\u1ec3.<\/p>\n\n\n\n<p class=\"is-style-big_icon_point\">\u0110\u1ec3 tham kh\u1ea3o v\u1ec1 t\u1ed1c \u0111\u1ed9 \u0111\u0103ng nh\u1eadp v\u00e0o d\u1ecbch v\u1ee5 c\u1ee7a ch\u00fang t\u00f4i sau khi chuy\u1ec3n h\u01b0\u1edbng \u0111\u1ebfn IIS v\u00e0 tr\u1ea3i qua x\u00e1c th\u1ef1c Windows, h\u00e3y xem t\u1ea1i \u0111\u00e2y<a href=\"https:\/\/chat-messenger.com\/dl\/mp3\/cam-iissso-l7redirect.mp4\">b\u1ed9 phim<\/a>Vui l\u00f2ng tham kh\u1ea3o tr\u01b0\u1edbc.<\/p>\n\n\n\n<h2>B\u1ea3ng so s\u00e1nh t\u1eebng c\u1ea5u h\u00ecnh<\/h2>\n\n\n\n<figure class=\"wp-block-table min_width10_\"><table style=\"--swl-cell1-width:70px;\"><thead style=\"--thead-color--bg:var(--color_gray);--thead-color--txt:var(--swl-text_color--black)\"><tr><th>th\u00e0nh ph\u1ea7n<\/th><th>T\u1ed5ng quan<\/th><th><span class=\"swl-fz u-fz-s\">X\u00e1c th\u1ef1c Windows<\/span><\/th><th>nh\u1eadn x\u00e9t<\/th><\/tr><\/thead><tbody><tr><td>\u2460<\/td><td>L7 LB (ch\u1ea5m d\u1ee9t SSL) \u2192 IIS<\/td><td>\u274c Kh\u00f4ng<\/td><td>\u30fbPh\u00e2n t\u00e1ch TLS, kh\u00f4ng truy\u1ec1n NTLM\/Kerberos<\/td><\/tr><tr><td>\u2461<\/td><td>L4 LB (chuy\u1ec3n ti\u1ebfp TLS) \u2192 IIS<\/td><td>\u2705 C\u00f3<\/td><td>\u30fbKh\u00f4ng th\u1ec3 \u0111\u1ecbnh tuy\u1ebfn theo \u0111\u01b0\u1eddng d\u1eabn. Thi\u1ebft l\u1eadp m\u00e1y ch\u1ee7 \u1ea3o th\u00e0nh LB v\u1edbi nhi\u1ec1u FQDN \u0111\u1ec3 \u0111\u1ecbnh tuy\u1ebfn.<br>- \u0110\u1eb7t ch\u1ee9ng ch\u1ec9 \u1edf ph\u00eda IIS (kh\u00f4ng c\u1ea7n ch\u1ee9ng ch\u1ec9 cho LB)<br>-C\u1ed5ng IIS 443 ch\u1ec9 cho ph\u00e9p k\u1ebft n\u1ed1i \u0111\u1ebfn t\u1eeb LB<br>\u30fbNh\u00ecn chung, c\u00f3 r\u1ea5t \u00edt t\u00e0i li\u1ec7u ch\u00ednh th\u1ee9c v\u00e0 r\u1ea5t kh\u00f3 \u0111\u1ec3<\/td><\/tr><tr><td>\u2462<\/td><td>L7 LB (ch\u1ea5m d\u1ee9t SSL) \u2192 Chuy\u1ec3n h\u01b0\u1edbng \u0111\u1ebfn IIS<\/td><td>\u2705 C\u00f3<\/td><td>\u30fbC\u00f3 s\u1eb5n \u0111\u1ecbnh tuy\u1ebfn d\u1ef1a tr\u00ean \u0111\u01b0\u1eddng d\u1eabn<br>\u30fbC\u1ea7n c\u00f3 ch\u1ee9ng ch\u1ec9 \u1edf ph\u00eda IIS v\u00e0 b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i<br>\u30fbC\u1ed5ng IIS 443 cho ph\u00e9p k\u1ebft n\u1ed1i \u0111\u1ebfn v\u1edbi B\u1ea4T K\u1ef2<br>\u30fbD\u1ec5 d\u00e0ng ki\u1ec3m tra v\u00ec IIS c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c ki\u1ec3m tra m\u1ed9t m\u00ecnh<\/td><\/tr><\/tbody><\/table><figcaption>B\u1ea3ng so s\u00e1nh t\u1eebng c\u1ea5u h\u00ecnh<\/figcaption><\/figure>\n\n\n\n<h2>b\u1ea3n t\u00f3m t\u1eaft<\/h2>\n\n\n\n<p>\u0110\u1ec3 x\u00e1c th\u1ef1c Windows (NTLM\/Kerberos) ho\u1ea1t \u0111\u1ed9ng b\u00ecnh th\u01b0\u1eddng, \u0111i\u1ec1u b\u1eaft bu\u1ed9c l\u00e0 phi\u00ean TLS ph\u1ea3i \u0111\u01b0\u1ee3c duy tr\u00ec xuy\u00ean su\u1ed1t t\u1eeb m\u00e1y kh\u00e1ch \u0111\u1ebfn IIS.<\/p>\n\n\n\n<p>Trong c\u1ea5u h\u00ecnh b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i L4 c\u1ee7a t\u00f9y ch\u1ecdn 2, TLS kh\u00f4ng \u0111\u01b0\u1ee3c chuy\u1ec3n ti\u1ebfp v\u00e0 truy\u1ec1n tr\u1ef1c ti\u1ebfp \u0111\u1ebfn IIS, do \u0111\u00f3 x\u00e1c th\u1ef1c th\u00e0nh c\u00f4ng. Tuy nhi\u00ean, r\u1ea5t kh\u00f3 c\u1ea5u h\u00ecnh v\u00ec n\u00f3 kh\u00f4ng cho ph\u00e9p \u0111\u1ecbnh tuy\u1ebfn theo \u0111\u01b0\u1eddng d\u1eabn chi ti\u1ebft v\u00e0 c\u1ea7n ph\u1ea3i c\u1ea5u h\u00ecnh nhi\u1ec1u m\u00e1y ch\u1ee7 \u1ea3o trong b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i.<\/p>\n\n\n\n<p>M\u1eb7t kh\u00e1c, c\u1ea5u h\u00ecnh chuy\u1ec3n h\u01b0\u1edbng trong T\u00f9y ch\u1ecdn 3 ch\u1ec9 \u0111\u01b0\u1ee3c b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i L7 x\u1eed l\u00fd l\u1ea7n \u0111\u1ea7u ti\u00ean, sau \u0111\u00f3 k\u1ebft n\u1ed1i tr\u1ef1c ti\u1ebfp \u0111\u1ebfn IIS, \u0111\u00e2y l\u00e0 lu\u1ed3ng l\u00fd t\u01b0\u1edfng theo quan \u0111i\u1ec3m c\u1ee7a TLS v\u00e0 x\u00e1c th\u1ef1c. B\u1eb1ng c\u00e1ch chuy\u1ec3n h\u01b0\u1edbng c\u00e1c \u0111\u01b0\u1eddng d\u1eabn c\u1ee5 th\u1ec3 \u0111\u1ebfn IIS FQDN, b\u1ea1n c\u00f3 th\u1ec3 \u0111\u1ea1t \u0111\u01b0\u1ee3c c\u1ea3 quy\u1ec1n ki\u1ec3m so\u00e1t quy t\u1eafc L7 v\u00e0 x\u00e1c th\u1ef1c Windows. C\u1ea7n ph\u1ea3i ki\u1ec3m tra xem c\u00f3 b\u1ea5t k\u1ef3 v\u1ea5n \u0111\u1ec1 ch\u00ednh s\u00e1ch n\u00e0o v\u1edbi IIS kh\u00f4ng n\u1eb1m trong LB cho ph\u00e9p c\u1ed5ng 443 l\u00e0 B\u1ea4T K\u1ef2 hay kh\u00f4ng.<\/p>\n\n\n\n<p>M\u1eb7t kh\u00e1c, trong c\u1ea5u h\u00ecnh nh\u01b0 T\u00f9y ch\u1ecdn 1, trong \u0111\u00f3 b\u1ed9 c\u00e2n b\u1eb1ng t\u1ea3i L7 th\u1ef1c hi\u1ec7n ch\u1ea5m d\u1ee9t TLS ho\u1eb7c di\u1ec5n gi\u1ea3i HTTP, th\u00f4ng tin x\u00e1c th\u1ef1c b\u1ecb gi\u00e1n \u0111o\u1ea1n v\u00e0 x\u00e1c th\u1ef1c Windows kh\u00f4ng ho\u1ea1t \u0111\u1ed9ng.<\/p>\n\n\n\n<p>Ch\u00fang t\u00f4i hy v\u1ecdng r\u1eb1ng b\u00e0i vi\u1ebft n\u00e0y s\u1ebd h\u1eefu \u00edch trong vi\u1ec7c xem x\u00e9t c\u1ea5u h\u00ecnh \u0111\u1ea1t \u0111\u01b0\u1ee3c c\u1ea3 c\u00e2n b\u1eb1ng t\u1ea3i v\u00e0 truy\u1ec1n th\u00f4ng \u0111\u01b0\u1ee3c m\u00e3 h\u00f3a trong khi v\u1eabn duy tr\u00ec h\u1ec7 th\u1ed1ng x\u00e1c th\u1ef1c m\u1ea1nh m\u1ebd.<\/p>","protected":false},"excerpt":{"rendered":"<p>\u7d71\u5408Windows\u8a8d\u8a3c\u306b\u3064\u3044\u3066 \u7d71\u5408Windows\u8a8d\u8a3c\uff08Integrated Windows Authenti [&hellip;]<\/p>","protected":false},"author":1,"featured_media":11704,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"swell_btn_cv_data":""},"categories":[9,33],"tags":[],"_links":{"self":[{"href":"https:\/\/chat-messenger.com\/vi\/wp-json\/wp\/v2\/posts\/11700"}],"collection":[{"href":"https:\/\/chat-messenger.com\/vi\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/chat-messenger.com\/vi\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/chat-messenger.com\/vi\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/chat-messenger.com\/vi\/wp-json\/wp\/v2\/comments?post=11700"}],"version-history":[{"count":9,"href":"https:\/\/chat-messenger.com\/vi\/wp-json\/wp\/v2\/posts\/11700\/revisions"}],"predecessor-version":[{"id":11920,"href":"https:\/\/chat-messenger.com\/vi\/wp-json\/wp\/v2\/posts\/11700\/revisions\/11920"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/chat-messenger.com\/vi\/wp-json\/wp\/v2\/media\/11704"}],"wp:attachment":[{"href":"https:\/\/chat-messenger.com\/vi\/wp-json\/wp\/v2\/media?parent=11700"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/chat-messenger.com\/vi\/wp-json\/wp\/v2\/categories?post=11700"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/chat-messenger.com\/vi\/wp-json\/wp\/v2\/tags?post=11700"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}